Kuji and your data (UK and EEA)

The one-paragraph answer

Almost everything Kuji knows stays on your phone, and we cannot see it. The names you type, the lists you save, who won and when: all of it lives in Kuji's own storage on your device. There is no account, no sign-in and no server holding it. Nothing you type is sent to us — not a name, not a list, not the identity of anyone who won. One thing can carry names off your phone, and it is yours to control: your own device backup, explained below. Usage and crash information leaves only if you switch it on yourself, and even then it carries no name and nothing you have typed. It does carry counts — how many took part in a round and how many won — because that is how we tell a two-person pick from a twenty-person one. A count is a number, never a name, and it cannot be turned back into one.

The one thing that happens without asking: Kuji asks the Google Play Store whether the Kuji Unsealed unlock has been bought on your account, when it starts and when you come back to it. That is how the unlock follows you to a new phone. It carries no names and nothing you have typed, and it is between your device and the store.

We do not sell your information, to anybody. There are no adverts in Kuji, and no data broker receives anything from it.

One part of that needs a caveat. Kuji shows you no adverts. But if you turn on Advertising measurement, we can measure which advert brought you here, and an advertising company does receive something in that case. It is never a name, a result, or anything you typed. See the Advertising measurement section below.

This page is the friendly summary. The Kuji Privacy Policy is the full and authoritative document, and the Cookie & SDK Notice goes further still, describing every third-party component one by one.

What stays on your phone

All of this is stored by Kuji on your device, in its own private space. We cannot read it, retrieve it, or produce it if someone asked us to. Not because we promise not to, but because it never reaches us in the first place.

One thing to know before the list. "Stays on your phone" means it never comes to us. It does not mean it can never leave the device at all: if your phone backs up app settings to your own cloud account, Kuji's settings file goes with it, and that file contains your saved lists. That copy sits in your account, not ours. It is explained under Your phone's own backup below, and it is the one thing on this page that can carry names off your phone.

What	In plain terms
Your saved lists of names	The people in your class, team or household. You can make three lists on the free tier, and as many as you like with Kuji Unsealed. Kuji nudges you to keep each list to about ten names, but that is a nudge about how the app looks, not a limit on what your phone keeps. This is the item your own device backup can copy
"Keep these two apart"	If you have asked Kuji not to put two particular people together, it remembers that pairing
Your pick history	A short history of recent picks: what was picked and when. Without Kuji Unsealed the record shows you fewer of them; the rest stay on your phone until newer picks push them out, and CLEAR removes them all
Your settings	Theme, colours, the finger style, sound and haptics, and your accessibility choices such as the calm mode
Your privacy choices	Which of the three optional settings you turned on or off, and which version of our privacy note you last saw
Whether you have Kuji Unsealed	A simple yes or no. A copy of the store receipt is kept alongside it only if Usage data is on, purely so the same unlock is not counted twice. Once kept, it stays until you clear the app's data or uninstall Kuji; turning Usage data off does not remove it. It is excluded from your device's backup

A note about the names, because they are usually not yours. If you are a teacher typing a class list, or a manager typing a team, those names belong to other people, and often to children. They stay on your device and we never see them. But they are those people's personal information, and you are the one looking after it. It is worth keeping your lists tidy and deleting the ones you have finished with.

Deleting any of it is instant. In the app menu, open Manage lists… (it is there whichever way Source is set) to delete a whole list, or to remove one person from a list. Either way you get five seconds to undo it. Clear your history with CLEAR in the The record pane. Or clear Kuji's data in your device settings, or uninstall the app, to remove everything at once.

One thing to know about backups. If your phone backs up app settings to your own cloud account, and most phones do this by default, then Kuji's settings file is included, and that file contains your saved lists. That backup sits in your account, not ours. We have no access to it and we cannot delete it for you. If you would rather it did not happen, turn off backup for Kuji in your device's settings.

What can leave your phone, and how to stop it

Almost nothing in this list happens unless you do something first. All three of the optional settings are off when you install Kuji, and the law in the UK and the EEA requires us to ask before an app stores or reads anything non-essential on your device. So a short panel asks you soon after Kuji first opens, picking is never delayed or interrupted to ask, and closing it without choosing grants nothing. The parts of the app that would send anything are not even switched on until you say yes.

This page covers the United Kingdom and the European Economic Area. If you live elsewhere, the Rest of World version of this page sets out the rights that apply to you.

The one exception is the store check described above. Kuji asks the Play Store whether you own the unlock each time it starts, whatever your settings say.

If you turn on Usage data

What we get: which modes and features get used — that a round started and a pick finished, how many took part and how many won, that a saved list was changed, that a setting was moved, that you hit a free-tier limit, that the upgrade screen appeared, that Kuji Unsealed was bought. Plus the ordinary technical details: an identifier for your installation, your app version, device model, operating system, and an approximate location worked out from your network address — down to a city, the coordinates of that city, and a postcode area. In the UK that is the first half of a postcode, like LU5 or SE8; in some other countries it is the full postal code.

Kuji asks for no location permission and reads no location API.

Two providers receive this. We send both of them the same information — the same list above, deliberately. What each one then holds is not identical: each adds its own ordinary technical details, and each keeps it for its own period. Both are set out provider by provider in the Cookie & SDK Notice, which also names them.

Both act on our instructions and for this purpose only. Neither is allowed to use any of it for its own ends.

What we never get: any name you have typed, who or what won, or anything else you have typed. Kuji records how the app is used, not what was picked or who was playing.

What we use it for. Working out what to build next — in Kuji, and in other apps we make, including ones we have not released yet. It is only counts and labels.

The approximate location is used for understanding how Kuji is doing area by area. It is a count per area, never a look at any one person. It does not change anything you see in the app, and it is not used to aim advertising at you.

If you turn on Crash reports

What we get: the technical record of a crash: where in the code it went wrong, your device model, operating system, app version, and an identifier for your installation.

What we never get: anything you have typed. Nothing you enter can appear in a crash report.

When you buy Kuji Unsealed

Google Play handles the purchase and takes the payment. We never see your card, your payment details or your billing address. Kuji keeps a yes/no "the unlock is active" on your device. It also sends the store's receipt back to confirm the purchase, which is what stops the store cancelling it, and if you have Usage data on it keeps a copy of that receipt.

If you turn on Advertising measurement

Off until you turn it on, like the others.

What we get: that you installed Kuji after seeing one of our adverts, and whether you later bought Kuji Unsealed. This uses an advertising identifier your phone provides, and information about the advert you tapped.

What we never get: any name you have typed, any of your lists, or anything else you have typed. The same rule as everything else.

Who else gets it: Meta and Google. Unlike our analytics providers, they use it for their own purposes too, not only ours, which is the difference between this switch and the other two. The Cookie & SDK Notice names them and links to their policies.

Turning it off: app menu → Sharing, same as the others. Your phone's own settings also let you reset or limit your advertising identifier at any time, for every app at once, and Kuji honours that too: if your phone says you have opted out of ads personalisation, we stop using the identifier whatever the switch says. That covers everything built on the identifier. Turning the switch off is what stops advertising measurement itself.

Your phone's own backup

As described above: your settings file, including your lists, goes into your cloud account if you have backup switched on. That is between you and your phone.

Changed your mind?

Open the app menu → Sharing. Turn Usage data, Crash reports or Advertising measurement off and it stops immediately. The analytics data cached on your phone is cleared and your analytics installation identifier is replaced with a new one, and any crash report not yet sent is deleted. The crash-reporting identifier is a separate one and is not replaced: it stays on your phone until you clear the app's data or uninstall Kuji. What the provider already received is not deleted at that moment. How long each provider and partner keeps it is set out in the Cookie & SDK Notice.

Turning your settings back to their defaults does not switch collection back on.

Your rights, and how to reach us

You have rights over your personal information: to see it, correct it, delete it, and object to how it is used. Because almost everything is on your device, you can act on most of them yourself, straight away, using the steps above. The Kuji Privacy Policy sets out the full list and how to use them.

Questions, or want us to do something?

Email privacy@tacitlabs.co.uk

Tacit Labs Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ

If you are in the European Economic Area, you can also contact our representative there: Euverify Ltd, Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland, or by email at gdpr@euverify.com. They also run a secure portal where you can check the appointment is genuine and send a request that gets logged and tracked. Any of these reaches us.

We aim to acknowledge within 5 working days, and to reply in full within one calendar month. That is our commitment wherever you are. If a request is complex we may need longer. The law allows up to two further months, and we will tell you within the first month if that applies.

If you are not happy with our answer, you can complain to a regulator:

If you are in	Complain to
The United Kingdom	The Information Commissioner's Office, at ico.org.uk/make-a-complaint
The European Economic Area	The data protection authority in the country where you live. The European Data Protection Board lists them