Privacy Policy for Hoshi: Star Sudoku

This policy describes how personal data is processed in Hoshi: Star Sudoku.

1. Controller and contact

The controller is:
Yakuma — Yassin Kuczma
c/o Online-Impressum 10897
Europaring 90
53757 Sankt Augustin

Email: mail@yakuma.de
Support: support@yakuma.de

2. Playing and age settings

Game saves, progress, settings, privacy settings, and your age settings are stored locally on your device so that the app can function and we can apply protection and consent rules. Until you make a selection, personalised advertising and Firebase Analytics remain disabled. If you are under 18, they remain disabled. Your age settings are not sent to Firebase Analytics and are not attached to analytics events. We send optional crash reports through Sentry only if you are at least 18 and have expressly opted in. Local data remains stored until you delete or reset the app or its data.

3. Optional Hoshi Account

A Hoshi Account is optional. On Android, we offer sign-in with Google, and on iOS we offer Sign in with Apple. When you sign in, we receive the account data released by the provider for authentication, in particular a provider identifier and, where applicable, an email address. Firebase Authentication may also process an authentication identifier, IP address, technical request information, and the time of sign-in. We also process your Hoshi Account ID and your chosen username.

We need this data to provide and protect your account and profile and to associate a Pro purchase with your account on supported devices. You can also use the app without an account. Game saves, progress, and virtual content are not synchronised to the cloud through the account. You can delete your account in the app under “Settings” → “Account”. This deletes the active Firebase Authentication account and the Hoshi cloud profile. Temporary backup or recovery copies are removed in accordance with Google’s contractual deletion periods.

4. Purchases, advertising, analytics, security, and support

Purchases and subscriptions. Apple or Google process payment, the store receipt, and the transaction identifier. RevenueCat processes the identifier it provides, product, purchase, and entitlement data, including the purchase time and information about the term of access, as required to provide, restore, and associate Hoshi Pro. When you delete an account, we remove its association with the Hoshi Account. Purchase and entitlement data may remain for as long as a store subscription is active or purchased access must be restored. Deleting an account does not cancel a store subscription. We do not receive payment data.

Advertising. We may display personalised, non-personalised, or limited ads. If you are under 18, we do not use personalised advertising. If you are at least 18, we use personalised advertising only with your consent and where further platform requirements are met.

Non-personalised ads may use information on your device, including mobile identifiers, for frequency capping and aggregated reporting. Where the required consent is absent, Google may instead serve limited ads. Functions that require a local identifier are not used for limited ads. Limited ads are not served programmatically.

Google AdMob and Google’s consent tools may process, in particular, your IP address, app and device information, advertising or device identifiers, technical timestamps, and your consent status. For age-appropriate consent and ad delivery, we tell Google only whether age-restricted treatment is required. We do not transmit your specific age setting. The consent tools store your choice on your device so that it can be respected and changed later. For more information about how Google uses data in its partners’ apps, see Google’s privacy information.

Analytics. Firebase Analytics is initially disabled. If you are at least 18, a Google consent form may be shown in the game. Firebase Analytics starts only after you expressly consent there. Earlier actions, including the first tutorial, are not collected later.

Only after your consent do we record events about game progress, level completions, hints used, trial screens and paywalls, theme previews and use, purchases, and offered or completed advertising rewards. After your consent, Firebase may additionally collect automatic technical events about app and session use. For purchases and subscriptions, this may include information about the product, price or value, currency, quantity, and subscription status. For more information about automatically collected events, see Google Analytics Help. If the app is temporarily offline, only events created afterwards may be cached locally. These events may include, for example, game mode, difficulty, result, or the source of an action. Firebase may process an app identifier and technical, usage, and timing information for this purpose. We do not send your age settings, account data, email address, or free-text content with these events.

In the Help Center under “Privacy”, you can reopen your privacy choices. You can also use “Stop Analytics and delete data” to stop Analytics for the future and request deletion from Google. Further collection stops immediately. If the deletion request cannot yet be transmitted and you delete the app data first, automatic transmission cannot continue. In this case and for other privacy requests, contact support@yakuma.de.

Security and stability. We use Firebase App Check to protect our Firebase services against abusive access. On Android, attestation uses Google Play Integrity. On iOS, we use Apple App Attest with Apple DeviceCheck as a fallback. Google and, on iOS, Apple process app and device integrity attestation material for this purpose. Firebase also processes time-limited App Check tokens and necessary network and timing information. This processing is independent of analytics and advertising.

If you are at least 18 and separately give voluntary consent to optional crash reports, we process technical data such as app and version information, operating system, device type, time, error message, and the technical sequence leading to the error. We use Sentry, with data stored in the European Union. Hoshi does not send account identifiers or separately configured profile data to Sentry.

Support. When you contact us, we process your email address, message, and information you provide in order to respond to your request. We use an IONOS mailbox to receive and store these emails.

5. Legal bases

Article 6(1)(b) GDPR applies to the app, the optional account, and purchases. Firebase App Check and general error diagnosis are based on our legitimate interests under Article 6(1)(f) GDPR in protecting our services against abusive access and fixing errors. Depending on the case, support requests are based on performance of a contract or our legitimate interests. Optional crash reports, personalised advertising, and Firebase Analytics are each processed only under the applicable consent pursuant to Article 6(1)(a) GDPR. We base the processing of technical data for non-personalised and limited advertising on our legitimate interests under Article 6(1)(f) GDPR in financing the app through advertising and providing ads securely and reliably. By contrast, we process local identifiers for non-personalised advertising only with your consent pursuant to Article 6(1)(a) GDPR. We process the local age setting based on our legitimate interest in protecting minors and applying consent rules.

Section 25 TDDDG additionally applies to storing or accessing information on your device. Where these operations are not strictly necessary, they take place only with your consent pursuant to Section 25(1) TDDDG. Local game saves, your settings, storage of your privacy choice, and necessary security and session tokens may be stored or accessed pursuant to Section 25(2) no. 2 TDDDG where this is strictly necessary for the app, account, or online function you request. Any subsequent processing of personal data is additionally governed by the legal bases under Article 6 GDPR stated above.

6. Requirement to provide data

A Hoshi Account is optional. Without the required sign-in data, you cannot use an account or profile or associate a Hoshi Pro purchase with your Hoshi Account; the basic game remains available without an account. Without local game saves and settings, progress and selected settings cannot be retained permanently.

Firebase Analytics and optional Sentry crash reports are voluntary. If you do not consent, this does not disadvantage your basic use of the game. Purchase, store, and RevenueCat data is required to purchase, provide, or restore Hoshi Pro. App Check tokens and the required attestation material may be necessary for protected online functions. If they cannot be provided, those online functions may be unavailable; local gameplay remains unaffected.

During free use, Google may serve an eligible ad depending on your privacy choices. If an ad cannot be requested or provided, directly ad-dependent functions may be temporarily unavailable.

7. Recipients and third countries

For AdMob, we and Google generally act as independent controllers for the respective processing activities. For individual AdMob functions, Google may act as a processor. Apple and Google process store purchases and sign-in services under their own responsibility to the applicable extent. You may obtain a copy of the relevant safeguards by contacting support@yakuma.de.

8. Retention periods

Local game, age, and consent data remain stored until the app data is deleted or reset. We delete locally cached analytics events no later than after seven days. App Check tokens are valid for no more than seven days. Where Firebase App Check retains tokens to protect against replay, it does so for no more than 30 days. After withdrawal, we retain an encrypted local deletion request only until Google confirms acceptance of the request. We retain a Hoshi Account and its RevenueCat association until the account is deleted. Purchase and entitlement data for anonymous purchases or active store subscriptions remain for as long as needed to provide or restore access. We delete support data after the request is completed unless statutory obligations require otherwise. We retain Sentry error reports for no more than 30 days. Firebase Analytics generally retains event data for 14 months. Certain associated user-level data may remain available for longer during continued use. According to Google, advertising data in server logs is progressively anonymised by removing parts of the IP address after nine months and cookie information after 18 months; individual data may be retained longer for security or legal obligations.

9. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection. Where our processing is based on legitimate interests, you may object on grounds relating to your particular situation. You may withdraw consent at any time with effect for the future; this does not affect the lawfulness of processing before the withdrawal. We generally respond to privacy requests within one month. For privacy requests, contact us at support@yakuma.de. You may in particular lodge a complaint with the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia. We do not make automated decisions that produce legal or similarly significant effects concerning you.

10. Additional information for California residents, where applicable

Where California privacy law applies to us, these notices supplement the information above. During the preceding twelve months, or since the app became available if that period is shorter, we have processed the following categories of personal information: identifiers (Hoshi Account ID, authentication identifier, where applicable email address, username, and advertising or device identifier), commercial information (purchases and entitlements), internet or other electronic network activity and device data (interactions, app version, operating system, device type, and error reports), and information in support requests. The data comes from you, your device, the sign-in and store providers you use, and our service providers.

We use this data to provide the app, account, and purchases; operate the app securely and reliably; provide support; and enable advertising and analytics in accordance with your settings. For these purposes, we may disclose the listed categories to the service providers named in Section 7 and, for store purchases, to Apple or Google. We do not sell personal information for monetary consideration. When personalised advertising is enabled, disclosure of advertising and device identifiers and usage data to Google AdMob may constitute “sharing” for cross-context behavioural advertising under California law. You may change your privacy choices under “Privacy” in the Help Center; non-personalised or limited advertising may still be displayed.

You may request access to your data, correction of inaccurate data, deletion, and opt out of the sharing described above. Exercising these rights will not result in discriminatory treatment. For requests, email support@yakuma.de; you can additionally delete your Hoshi Account in accordance with our account-deletion instructions. To verify a request, we may require reasonable information to confirm your identity and generally respond within 45 days, unless the law permits otherwise.

11. Changes

Where legally required, we will inform you of material changes. The current version is available at https://yakuma.de/en/games/hoshi/legal/privacy-policy.