This Privacy Policy describes how kodobit ("we", "us") handles information in connection with the mobile game "XPBoost" (the "Game"), available on Google Play. The Game is a simple clicker/tapping game with online leaderboards, achievements, and advertising.
For the purposes of the EU/UK General Data Protection Regulation and the Serbian Law on Personal Data Protection ("Zakon o zaštiti podataka o ličnosti"), the data controller for the limited processing we determine is:
kodobit
Belgrade, Serbia
Email: info@kodobit.com
The advertising and identity partners named below act as independent or joint controllers for their own processing, governed by their own privacy policies.
We, as the developer, do not operate our own servers for the Game and do not directly collect, store, or sell your personal information. However, the Game integrates the following third-party services, which may collect certain data as described below.
Google AdMob (Google Mobile Ads SDK) — used to display banner advertisements and optional rewarded video advertisements. AdMob may collect and process data including your device's advertising identifier (Advertising ID / App Set ID), IP address, coarse location derived from IP address, device information (model, operating system version, language, screen characteristics), app information, and ad interaction data (impressions, clicks, view duration), for the purposes of serving, measuring, and — where you have consented — personalizing advertising, and for preventing fraud and abuse.
Google Play Games Services (v2) — used for player sign-in, leaderboards, and achievements. When you sign in, Google processes your Play Games player ID, gamer tag (display name), avatar, and your in-game score, which is submitted to public leaderboards. Your gamer tag and score may be visible to other players on the leaderboard. We receive only the player ID and gamer tag necessary to display and attribute your score; we do not receive your Google Account email address.
Google User Messaging Platform (UMP) — used to request, record, and manage your advertising consent and privacy choices where required by law. UMP is a Consent Management Platform (CMP) certified by Google and registered with the IAB Europe Transparency & Consent Framework (TCF) v2.2. Your choices are stored on your device and transmitted, in the form of a TCF consent string or an equivalent US privacy signal, to advertising vendors so they can act on them.
We do not collect precise (GPS-level) location. The Game does not request location permissions. Any location inference by our advertising partners is coarse and derived from your IP address, unless you separately grant the precise geolocation special feature in the consent form.
We do not knowingly process any special-category or sensitive personal data — such as health, biometric, precise location, racial or ethnic origin, religious beliefs, sexual orientation, or government identifiers — and we do not use any such data for advertising or profiling.
Your click count, XP total, level, and game progress are stored locally on your device only. This data never leaves your device except as a numeric score submitted to the Google Play Games leaderboard. Your consent choices are also stored locally by the UMP SDK. Uninstalling the Game deletes this local data.
The Game shows banner ads and optional rewarded video ads, which you choose to watch in exchange for in-game bonuses. How consent is handled depends on where you are located.
If you are located in the EEA, the UK, or Switzerland, the Game presents a consent form on first launch, delivered by the Google User Messaging Platform. This form is a Google-certified CMP registered with the IAB Europe Transparency & Consent Framework (TCF) v2.2, and the Game is operated in accordance with Google's EU User Consent Policy.
Through that form you are asked to consent to, or object to, purposes including:
Some vendors may process limited data on the basis of legitimate interests rather than consent — for example for security, fraud prevention, debugging, and technical ad delivery. Where a vendor relies on legitimate interests, the same consent form lets you object.
The advertising vendors that may receive your data are those you can review inside the consent form itself, and are listed publicly by Google in its Ad Technology Providers list and by IAB Europe in its TCF Global Vendor List.
You can review and change every one of these choices at any time, including withdrawing consent entirely, via the Ad Preferences option inside the Game. Withdrawing consent is as easy as giving it, and does not affect the lawfulness of processing carried out before withdrawal. If you decline or withdraw consent, the Game continues to work and you will be shown non-personalized or limited advertising instead.
If you are located in a US state with a comprehensive consumer privacy law, the Game uses the AdMob "US states" privacy message delivered through the User Messaging Platform. This gives you the ability to opt out of the "sale" or "sharing" of your personal information and of targeted advertising, by signalling restricted data processing to Google and other participating vendors.
This applies to residents of states including California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, and Maryland, as those laws come into effect. Depending on your state, you may have the right to know what personal information is collected, to access and delete it, to correct it, to obtain it in a portable form, to opt out of targeted advertising, sale, sharing, and certain profiling, and not to be discriminated against for exercising those rights.
We do not sell your personal information for money. Some advertising activity may nonetheless constitute a "sale" or "share" under California law, which is precisely what the opt-out described above addresses. You can exercise it at any time via Ad Preferences inside the Game, or by contacting us at info@kodobit.com. We also honour opt-out preference signals such as Global Privacy Control where our advertising partners transmit and support them.
We do not knowingly sell or share the personal information of consumers under 16 years of age.
Where local law does not require a consent form, ads may be personalized by default. You can still limit personalization using the device-level controls described below, and you can still open Ad Preferences in the Game to view your current privacy options.
Independently of the in-game form, you can limit ad personalization system-wide via your device settings: Settings → Google → Ads, which lets you delete or reset your Advertising ID and opt out of ad personalization across apps.
Where the GDPR or UK GDPR applies, processing relies on the following bases:
Our service providers, principally Google, process data on servers located in the United States and other countries outside the EEA, the UK, and Serbia. Where personal data is transferred out of those territories, the transfer is protected by the European Commission's Standard Contractual Clauses — and the UK International Data Transfer Addendum where applicable — together with supplementary technical measures such as encryption in transit and at rest. Details are set out in Google's own privacy documentation linked in section 10.
We do not retain personal data ourselves, as we operate no servers for the Game. Retention by our partners is as follows:
Depending on your location, you may have rights to access, correct, delete, or port your personal data, to object to or restrict processing, to withdraw consent at any time, to opt out of targeted advertising and the sale or sharing of personal information, and to lodge a complaint with a supervisory authority.
EEA and UK users may complain to their national data protection authority. Serbian users may complain to the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti). US state residents may contact their state Attorney General.
To exercise any right relating to data held by us, email info@kodobit.com. We respond within the period required by applicable law — generally one month under the GDPR and 45 days under US state laws — and we do not charge a fee or discriminate against you for making a request. Because most data described in this policy is held by Google rather than by us, we may direct you to Google's own controls where that is the faster route, and we will tell you plainly when that is the case.
Game progress can be deleted by clearing the app's data or uninstalling the Game. To manage or delete your Google Play Games profile data, including leaderboard entries tied to your gamer tag, use Google's Play Games settings or visit your Google Account. To reset the advertising identifier associated with ad data, use Settings → Google → Ads on your device. For any deletion request or privacy question relating to the Game, contact us at the address below and we will assist you.
The Game is not directed at children. It is rated and distributed for a general audience, and we do not knowingly collect personal information from children under 13, or under the applicable age of digital consent in your region (13 to 16 across the EEA).
The Game does not tag ad requests as child-directed, because it is not designed for or primarily targeted at children within the meaning of the US Children's Online Privacy Protection Act (COPPA) or the Google Play Families Policy. Where the User Messaging Platform indicates that a user is below the age of consent in their region, ad requests are handled accordingly and personalized advertising is not served.
If you believe a child has provided personal information through the Game, please contact us so we can delete it and take appropriate action.
The Game requires an active internet connection and communicates only with Google services over encrypted TLS connections. We do not transmit your data to any server operated by us, and we hold no credentials or account data of yours.
We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated effective date, and where the change affects the purposes or vendors covered by your consent, the consent form will be shown again. Continued use of the Game after changes take effect constitutes acceptance of the revised policy.
kodobit
Belgrade, Serbia
Email: info@kodobit.com