Privacy Policy

1. Controller and scope KM Works Co., Ltd. operates Sudoku God and is responsible for the personal data described here. The app is intended for users aged 9 and older. 2. Data stored on the device The app stores the selected age band, language, settings, puzzle progress, local game history, notification settings, advertising frequency state, and random player credentials on the device. The age band is used locally for age-appropriate privacy and advertising controls and is not sent to our server or Google. A guardian birth year entered for child photo-upload verification is checked only in memory and is not stored or transmitted. 3. Online identity, rankings, and service logs We process a random public player code, a server-side hash of the player secret, difficulty, score, elapsed time, mistakes, hints, puzzle identifier, and submission time. Server access and security logs may include IP address, request time, user agent, platform, app version and build, language, and country setting. Public player codes and ranking results are visible to other users but are designed not to directly identify a person. 4. My Sudoku data When you choose to register a board, the app accesses the selected camera or gallery image. Recognition is primarily performed on the device. After you confirm the cropped Sudoku area and recognized puzzle, the cropped image, extracted puzzle, solution and difficulty analysis, attempts, completion records, times, mistakes, and hints are stored on our server under the random player identity and remain private by default. If you choose Publish, only the puzzle digits, clue count, difficulty, and publication time are available to other authenticated app users. The uploaded image, solution, random player code, attempts, and completion records remain private. A user who copies a public puzzle receives a new independent puzzle record and a server-rendered board image, never the source upload. Existing copies remain until their owners delete them even if the original is unpublished or deleted. My Sudoku images and records are not used for advertising or general AI model training. 5. Advertising and consent data The app uses Google AdMob and Google User Messaging Platform. Depending on age, region, consent, and device settings, Google and its advertising partners may process IP address and approximate location derived from it, app and ad interactions, diagnostic and performance data, Android advertising ID, app set ID, and other device identifiers for ad delivery, measurement, analytics, security, and fraud prevention. For users aged 9–12, the app requests child-directed treatment, limits ad content to G-rated content, and does not request use of the Android advertising ID for personalized advertising. Users aged 13–17 are treated as under the age of consent for advertising requests. Privacy choices are available under Settings > Ad privacy choices when required. See https://policies.google.com/privacy and https://policies.google.com/technologies/ads. 6. Purposes and legal bases We process data to provide the game, authenticate players, operate rankings and My Sudoku, recognize and validate puzzles, save progress, provide updates and localized content, deliver and measure advertising, prevent abuse, secure and improve the service, diagnose failures, comply with law, and answer support requests. Legal bases may include performance of the requested service, consent where required, legitimate interests in operation and security, and legal obligations. 7. Sharing and international processing We do not sell personal data. Data may be processed by hosting and infrastructure providers acting under our instructions, Google and advertising partners as described above, authorities when legally required, or a lawful business successor. Our service server is operated in the Republic of Korea. Google may process advertising data in other countries under its safeguards and applicable law. 8. Children and family protections The app does not request a child's real name, contact details, precise location, contacts, or microphone. Users below age 9 are blocked before server and advertising requests. For ages 9–12, child-directed advertising controls apply and an adult guardian check is required before camera or gallery upload. Parents or guardians may request review or deletion. 9. Permissions Camera or system photo-picker access is requested only when you choose to register My Sudoku. Notification permission may be requested for reminders scheduled on the device. Normal play does not require contacts, microphone, or precise location permission. 10. Retention Ranking and My Sudoku data are retained while the service operates or until deletion. A valid in-app deletion request removes the player, rankings, My Sudoku images, puzzles, attempts, and completion records. Security access logs may be retained for up to 90 days. Support correspondence may be retained for up to three years. Data required by law, security, or fraud prevention may be retained separately for the applicable period. 11. Your rights and deletion You may request access, correction, deletion, restriction, or other rights available under applicable law. Use Settings > Delete my data for immediate authenticated deletion, or follow https://service.kmworks.co.kr/sudokugod/data-deletion. If you contact support, we may request reasonable verification. Deleting the app alone removes local data but does not automatically delete server data. 12. Security We use HTTPS encryption in transit, access controls, secret hashing, owner checks, and transactional deletion. No method can guarantee absolute security. 13. Changes Material changes will be announced in the app or on the service website before taking effect when reasonably possible. The effective date identifies the current version. 14. Contact KM Works Co., Ltd. 98, Gasan digital 2-ro, Geumcheon-gu, Seoul, Republic of Korea Email: sudokugod.cs@gmail.com 15. Purchase and entitlement data When you buy or restore ad removal, the store processes your payment account and payment method under its own privacy policy. We do not receive card or bank-account details. The app sends the product ID and store verification token or receipt to our server over encrypted transport. The server obtains and processes the store, platform, product and purchase-option identifiers, transaction or order ID, purchase state and time, acknowledgement state, test-purchase indicator, and the random app player identity to verify the purchase, acknowledge it where applicable, grant or restore ad removal, detect refunds or revocations, prevent duplicate or fraudulent use, and handle support and legal obligations. The raw Google Play purchase token is not stored in our database; only its SHA-256 hash is retained. Deleting player data removes the link between the player and the entitlement. A minimal, separated transaction audit record may be retained for the period reasonably necessary for refunds, fraud prevention, accounting, dispute handling, and applicable legal obligations, and can support a later store-authorized restoration. Google processes Android purchase data and may process it in other countries under its safeguards. Apple performs the corresponding verification and payment processing for iOS purchases.