Kaya Rock Media

Privacy Policy

Last updated: [date]

1. Controller

Kaya Rock Media, owner [First name Last name], [Street No.], [Postcode City], Germany Email: support@kayarockmedia.com · Phone: +49 178 6309283

2. In short

3. Data we process

3.1 Game progress on your device

What: progress, coins, ranks, settings, daily rewards. Where: only locally in the TikTok app storage on your device; we do not receive it. Legal basis: Section 25(2) no. 2 TDDDG (strictly necessary), Art. 6(1)(b) GDPR. Deletion: when you delete the game or its data in the TikTok app.

3.2 Login via TikTok (platform requirement)

TikTok Mini Games must use TikTok login ("silent login"). TikTok gives the game a one-time code; our server function exchanges it with TikTok for a game-specific user ID (open_id). We do not receive your name, email, profile picture or phone number. The exchange runs on Cloudflare, Inc. (processor under Art. 28 GDPR). The function stores neither code nor ID and does not log them. Cloudflare technically processes your IP address; [logs disabled / retention …]. Legal basis: Art. 6(1)(b) GDPR, Art. 6(1)(f) GDPR (security). Transfers: Cloudflare may process data in the USA; Cloudflare is certified under the EU-US Data Privacy Framework; Standard Contractual Clauses apply in addition. [lawyer: verify]

3.3 Advertising (by TikTok)

Ads are shown only via TikTok (rewarded videos at your request, occasional interstitials). We do not integrate other ad networks and receive no personal data from ads, only aggregated payout reports. [OPEN – clarify with TikTok] Whether ads are personalised is decided by TikTok based on your TikTok ad settings. Controller for ad data processing: [TikTok Technology Limited, Ireland / jointly with us under Art. 26 GDPR …]. Legal basis for personalised ads: your consent given to TikTok (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). TikTok privacy policy: https://www.tiktok.com/legal/privacy-policy-eea

3.4 In-game purchases (if offered)

Purchases are processed by TikTok using "Beans". We do not receive payment details. We receive order ID, open_id, item, amount, time and status to deliver your purchase and meet legal obligations. Storage: [provider, location]. Legal basis: Art. 6(1)(b) and (c) GDPR. Retention: as long as needed for delivery, then statutory retention periods (6, 8 or 10 years).

3.5 Downloading game content (if used)

Larger content (e.g. cutscene videos) may be loaded from [provider/domain]. Your IP address is processed for delivery. [logging off / retention …] Legal basis: Art. 6(1)(b) GDPR.

3.6 This website

Hosted by [host]. Access data (IP address, time, browser) is processed for secure delivery (Art. 6(1)(f) GDPR). No cookies, no analytics.

3.7 Contact by email

We process your message and email address to answer you and delete them once done, unless we must retain them by law.

3.8 Our apps on the App Store (Apple) and Google Play

Section 3.1 applies (progress stored on your device only); sections 3.2–3.4 (TikTok) do not apply to the apps. There is no login.

a) Advertising via Google AdMob. The apps show rewarded videos (only when you start them) and occasional interstitial ads, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This may involve your device's advertising ID (Android advertising ID or Apple IDFA – only if you allow it), IP address, device and app information (model, OS, language), ad interactions and approximate location derived from the IP address. Google uses this to serve, measure and secure ads and – only with your consent – to personalise them. Consent: on first launch the app shows Google's consent dialog (certified CMP under IAB TCF). On iPhone, Apple also asks whether the app may track your activity across other companies' apps (App Tracking Transparency). Without consent, Google shows only non-personalised or limited ads. You can change your choice at any time under Info → Ad consent ("Werbe-Einwilligung") or, on iPhone, under Settings → Privacy → Tracking. Legal basis: consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG); for non-personalised ads and fraud prevention, legitimate interest (Art. 6(1)(f) GDPR, financing the free game). [Lawyer: check basis for limited ads and joint controllership] Third countries: Google may process data in the USA (EU-US Data Privacy Framework, standard contractual clauses). Google privacy policy: https://policies.google.com/privacy · How Google uses data from apps: https://policies.google.com/technologies/partner-sites

b) Purchases. Purchases (coin packs, "Remove ads", starter pack) are processed by Apple (App Store) or Google (Google Play). We never receive your payment details – only the store's confirmation (product, order ID, time) to credit your purchase; the order ID is stored on your device only (to avoid crediting a purchase twice). For payouts and taxes we receive aggregated reports. "Restore purchases" asks the store which one-time purchases belong to your store account. Legal basis: Art. 6(1)(b) GDPR (contract), Art. 6(1)(c) GDPR (retention obligations).

c) Vibration and sound use your device's functions only; no data is transmitted.

4. What we do not do

No cookies of our own, no tracking, no profiling, no sale of data, no automated decision-making under Art. 22 GDPR, no chat or contact features between players.

5. Children

TikTok requires users to be at least 13. Our games (including the apps) are not directed at children under 13. We do not knowingly collect data from children under 13.

6. Your rights

Access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20) and objection (21 GDPR). You can withdraw consent at any time for the future (ads on TikTok: in your TikTok settings; in our apps: Info → Ad consent). Contact support@kayarockmedia.com; please name the game and, for purchases, the order ID. You may lodge a complaint with a supervisory authority, e.g. [competent German authority for Kaya's address].

7. Changes

We update this policy when our games or the law change. The version published here applies.