Privacy

Privacy Policy

Effective: September 24, 2026

Coloramus is operated by Codera, Zagreb, Croatia. For users covered by the GDPR, Codera is the controller of the personal data described below. Privacy questions can be sent to contact@codera.hr.

What Coloramus processes

• Account identity: Firebase Authentication creates a random player identifier for every user. You can play without registering. If you create a persistent account, authentication may use email/password, Google, or Apple depending on your platform. Coloramus uses your chosen nickname as your in-game identity; it does not require your first or last name. Authentication providers may process account identifiers and email addresses needed to sign you in. Coloramus application/backend code does not store or read your plaintext password.
• Competitive game data: when you start an online run, the backend stores your player ID, a random run identifier, game mode and trusted start/expiry timestamps.
• Leaderboard data: your player ID, chosen nickname or generated guest label, best score, verification flag and update time may be stored for leaderboard functionality.
• Local device data: settings, tutorial state, local best/recent scores, free-play counters and a cached Premium entitlement are stored on your device.
• Usage analytics: Firebase Analytics is disabled by default. On each app launch, Coloramus asks Google's User Messaging Platform (UMP) for the current privacy/consent state without showing an advertising-consent form during normal gameplay. Analytics is enabled only when UMP's Google Consent Mode values indicate that the relevant purposes are granted or that European consent requirements do not apply. If consent is denied, not yet available, or Consent Mode is not correctly configured, Analytics stays disabled. When enabled, it is used to understand game and monetization flows such as game starts/completions, scores, personal-best events, free-play limits, rewarded-ad flow and Premium purchase flow. Custom Coloramus Analytics events are designed not to include your name, email address or other directly identifying contact details.
• Diagnostics: Firebase Crashlytics processes crash reports, diagnostics and app/device information needed to investigate stability problems. Coloramus may attach non-sensitive technical context such as monetization state, remaining-play state and Remote Config status to crash reports.
• Advertising: Coloramus uses Google AdMob for optional rewarded ads. Google Mobile Ads may process information such as IP address, app/ad interactions, diagnostics and device or advertising identifiers, depending on your device settings, region and consent choices. IP address may be used to infer a general location. Coloramus does not show banner or forced interstitial ads.
• Purchases: Apple or Google processes payment details for in-app purchases. Coloramus receives purchase/product status and verification information needed to unlock or restore Premium; Coloramus does not receive your full payment-card details.

Why we process it

We use this information to provide the game and leaderboard, preserve progress and entitlements, measure whether the game is working as intended, diagnose crashes, prevent abuse, offer optional rewarded advertising and process/restore Premium access.

Legal bases and consent

Where the GDPR applies, processing needed to provide requested game, account, leaderboard and purchase functionality is based on providing the service you choose to use. We rely on legitimate interests where appropriate for service reliability, security, abuse prevention and crash diagnostics. Where consent is required for Analytics, advertising, device identifiers or related processing, Coloramus uses Google's User Messaging Platform and Google Consent Mode to request and respect the applicable privacy choices. Analytics starts disabled and remains disabled unless the consent state allows it. Advertising consent, when required, is collected before Coloramus requests a rewarded ad.

Your advertising and privacy choices

Rewarded ads are optional: you choose whether to watch an ad in exchange for additional free plays. Coloramus refreshes UMP consent information in the background when the app starts, but it does not interrupt the initial free-play experience with an advertising-consent form. If a consent form is required, it is shown when you choose to use a rewarded ad. Where Google requires a privacy-options entry point, Coloramus exposes it in Settings so you can review or change the available choices; Analytics collection is updated again after those choices change. Premium users do not need rewarded ads to continue playing.

What we do not use

Coloramus does not request precise GPS location, contacts, photos, health data or microphone recordings for gameplay. It has no social feed. Google and Apple sign-in are optional account-login methods only. Coloramus does not use your provider profile name as your in-game identity; you choose a Coloramus nickname. Coloramus does not request your provider friends or contacts. We do not sell personal data.

Service providers and international processing

Coloramus uses Google Firebase / Google Cloud services including Authentication, Cloud Functions, Firestore, Analytics, Crashlytics, Remote Config and Hosting. It also uses Google Mobile Ads / User Messaging Platform for rewarded advertising and consent management. Google may process data on infrastructure in multiple countries under its applicable data-processing and international-transfer safeguards.

In-app purchases are processed by Apple App Store or Google Play according to the store you use. Their own privacy terms also apply to data they process as store/payment providers.

Retention

An active competitive run is deleted after a valid score submission and is overwritten when a new run starts. Leaderboard best scores and the Firebase Authentication account remain until deleted. Local device data remains until you clear app data or uninstall the app, subject to store-restored purchase entitlements. Analytics, crash diagnostics, advertising and store transaction records are retained according to the applicable service configuration and provider terms.

Your choices and deletion

You can permanently delete your Coloramus online account and its Coloramus online account/leaderboard data from Settings → Delete account & online data. This applies to guest, email/password, Google and Apple-linked Coloramus accounts. Store purchase records and data independently controlled by Apple or Google are not deleted by deleting the Coloramus account. For an external deletion request, see the account deletion page.

Your privacy rights

Depending on applicable law, you may have rights to request access, correction, deletion, restriction, portability or objection regarding personal data associated with you. We may need the Player ID shown in Settings and, for a registered account, the account email address to locate the relevant Coloramus record. Rights requests can be sent to contact@codera.hr.

If you are in the EEA and believe your data-protection rights have been violated, you may also lodge a complaint with your local supervisory authority. In Croatia, the supervisory authority is the Croatian Personal Data Protection Agency (AZOP).

Children

Coloramus is not specifically directed at children. No registration or contact profile is required to play. Users who choose to create a persistent account provide an authentication identity and a nickname. Parents or guardians may contact us about privacy or deletion questions.

Changes

We may update this policy when the app or its data practices change. The effective date above will be updated when material changes are published.