Kuji and your data: the short version
Applies to: the Kuji app, outside the United Kingdom and outside the European Economic Area
The one-paragraph answer
Almost everything Kuji knows stays on your phone, and we cannot see it. The names you type, the lists you save, who won and when: all of it lives in Kuji's own storage on your device. There is no account, no sign-in and no server holding it. Nothing you type is sent to us — not a name, not a list, not the identity of anyone who won. One thing can carry names off your phone, and it is yours to control: your own device backup, explained below. Usage and crash information leaves only if you switch it on yourself, and even then it carries no name and nothing you have typed. It does carry counts — how many took part in a round and how many won — because that is how we tell a two-person pick from a twenty-person one. A count is a number, never a name, and it cannot be turned back into one.
The one thing that happens without asking: Kuji asks the Google Play Store whether the Kuji Unsealed unlock has been bought on your account, when it starts and when you come back to it. That is how the unlock follows you to a new phone. It carries no names and nothing you have typed, and it is between your device and the store.
We do not sell your information, to anybody. There are no adverts in Kuji, and no data broker receives anything from it.
One part of that needs a caveat. Kuji shows you no adverts. But if you turn Advertising measurement on, an advertising company does receive something: the fact that you installed Kuji after seeing an advert, and whether you bought Kuji Unsealed. Never a name, a result, or anything you typed.
That counts as sharing for cross-context behavioural advertising, which is why it is its own switch, off until you turn it on, and never bundled with the other two.
This page is the friendly summary. The Kuji Privacy Policy is the full and authoritative document, and the Cookie & SDK Notice goes further still, describing every third-party component one by one.
What stays on your phone
All of this is stored by Kuji on your device, in its own private space. We cannot read it, retrieve it, or produce it if someone asked us to. Not because we promise not to, but because it never reaches us in the first place.
One thing to know before the list. "Stays on your phone" means it never comes to us. It does not mean it can never leave the device at all: if your phone backs up app settings to your own cloud account, Kuji's settings file goes with it, and that file contains your saved lists. That copy sits in your account, not ours. It is explained under Your phone's own backup below, and it is the one thing on this page that can carry names off your phone.
| What | In plain terms |
|---|---|
| Your saved lists of names | The people in your class, team or household. You can make three lists on the free tier, and as many as you like with Kuji Unsealed. Kuji nudges you to keep each list to about ten names, but that is a nudge about how the app looks, not a limit on what your phone keeps. This is the item your own device backup can copy |
| "Keep these two apart" | If you have asked Kuji not to put two particular people together, it remembers that pairing |
| Your pick history | A short history of recent picks: what was picked and when. Without Kuji Unsealed the record shows you fewer of them; the rest stay on your phone until newer picks push them out, and CLEAR removes them all |
| Your settings | Theme, colours, the finger style, sound and haptics, and your accessibility choices such as the calm mode |
| Your privacy choices | Which of the three optional settings you turned on or off, and which version of our privacy note you last saw |
| Whether you have Kuji Unsealed | A simple yes or no. A copy of the store receipt is kept alongside it only if Usage data is on, purely so the same unlock is not counted twice. Once kept, it stays until you clear the app's data or uninstall Kuji; turning Usage data off does not remove it. It is excluded from your device's backup |
A note about the names, because they are usually not yours. If you are a teacher typing a class list, or a manager typing a team, those names belong to other people, and often to children. They stay on your device and we never see them. But they are those people's personal information, and you are the one looking after it. It is worth keeping your lists tidy and deleting the ones you have finished with.
Deleting any of it is instant. In the app menu, open Manage lists… (it is there whichever way Source is set) to delete a whole list, or to remove one person from a list. Either way you get five seconds to undo it. Clear your history with CLEAR in the The record pane. Or clear Kuji's data in your device settings, or uninstall the app, to remove everything at once.
One thing to know about backups. If your phone backs up app settings to your own cloud account, and most phones do this by default, then Kuji's settings file is included, and that file contains your saved lists. That backup sits in your account, not ours. We have no access to it and we cannot delete it for you. If you would rather it did not happen, turn off backup for Kuji in your device's settings.
What can leave your phone, and how to stop it
All three settings are off when you install Kuji, and a short panel asks you soon after it first opens. That is the same everywhere this page covers, including the United States: we ask everyone, whether or not the law of their country requires it. You can turn any of them on or off at any time, and a change takes effect immediately: app menu → Sharing.
This page covers everywhere outside the United Kingdom and the European Economic Area. If you live in either, the UK and EEA version of this page sets out the rights that apply to you.
The store check is the one thing that happens regardless. Kuji asks the Play Store whether you own the unlock each time it starts, whatever your settings say.
While the Usage data switch is on
What we get: which modes and features get used — that a round started and a pick
finished, how many took part and how many won, that a saved list was changed, that a setting
was moved, that you hit a free-tier limit, that the upgrade screen appeared, that Kuji
Unsealed was bought. Plus the ordinary technical details: an identifier for your installation,
your app version, device model, operating system, and an approximate location worked out from
your network address — down to a city, the coordinates of that city, and a postcode area.
In the UK that is the first half of a postcode, like LU5 or SE8; in some other countries it
is the full postal code.
Kuji asks for no location permission and reads no location API.
Two providers receive this. We send both of them the same information — the same list above, deliberately. What each one then holds is not identical: each adds its own ordinary technical details, and each keeps it for its own period. Both are set out provider by provider in the Cookie & SDK Notice, which also names them.
Both act on our instructions and for this purpose only. Neither is allowed to use any of it for its own ends.
What we never get: any name you have typed, who or what won, or anything else you have typed. Kuji records how the app is used, not what was picked or who was playing.
What we use it for. Working out what to build next — in Kuji, and in other apps we make, including ones we have not released yet. It is only counts and labels.
The approximate location is used for understanding how Kuji is doing area by area. It is a count per area, never a look at any one person. It does not change anything you see in the app, and it is not used to aim advertising at you.
While the Crash reports switch is on
What we get: the technical record of a crash: where in the code it went wrong, your device model, operating system, app version, and an identifier for your installation.
What we never get: anything you have typed. Nothing you enter can appear in a crash report.
When you buy Kuji Unsealed
Google Play handles the purchase and takes the payment. We never see your card, your payment details or your billing address. Kuji keeps a yes/no "the unlock is active" on your device. It also sends the store's receipt back to confirm the purchase, which is what stops the store cancelling it, and while Usage data is on it keeps a copy of that receipt.
While the Advertising measurement switch is on
It is off when you install Kuji, and stays off until you turn it on: app menu → Sharing, or on the panel that appears soon after Kuji first opens.
What we get: that you installed Kuji after seeing one of our adverts, and whether you later bought Kuji Unsealed. This uses an advertising identifier your phone provides, and information about the advert you tapped.
What we never get: any name you have typed, any of your lists, or anything else you have typed. The same rule as everything else.
Who else gets it: Meta and Google. Unlike our analytics providers, they use it for their own purposes too, not only ours, which is the difference between this switch and the other two. The Cookie & SDK Notice names them and links to their policies.
Turning it off: app menu → Sharing, same as the others, and leaving it alone means it never starts. Your phone's own settings also let you reset or limit your advertising identifier at any time, for every app at once, and Kuji acts on that as an opt-out too: Android sends no Global Privacy Control signal, but it does have a system advertising opt-out, and once your phone reports it we stop using the identifier whatever the switch says. The two are not equivalent: the phone setting stops everything built on the identifier, and the switch in the app is what stops advertising measurement itself.
Your phone's own backup
As described above: your settings file, including your lists, goes into your cloud account if you have backup switched on. That is between you and your phone.
Changed your mind?
Open the app menu → Sharing. Turn Usage data, Crash reports or Advertising measurement off and it stops immediately. The analytics data cached on your phone is cleared and your analytics installation identifier is replaced with a new one, and any crash report not yet sent is deleted. The crash-reporting identifier is a separate one and is not replaced: it stays on your phone until you clear the app's data or uninstall Kuji. What the provider already received is not deleted at that moment. How long each provider and partner keeps it is set out in the Cookie & SDK Notice.
Turning your settings back to their defaults does not switch collection back on.
Your rights, and how to reach us
You have rights over your personal information: to see it, correct it, delete it, and object to how it is used. Because almost everything is on your device, you can act on most of them yourself, straight away, using the steps above. The Kuji Privacy Policy sets out the full list and how to use them.
Questions, or want us to do something?
Email privacy@tacitlabs.co.uk
Tacit Labs Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ
We aim to acknowledge within 5 working days, and to reply in full within one calendar month. That is our commitment wherever you are. If a request is complex, or you have made several, we may need up to two further months, and we will tell you within the first month if we do, and why.
If you are not happy with our answer, you can complain to the data protection authority where you live. We are based in the United Kingdom, so you can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.