Kuji Privacy Policy (UK and EEA)
1. Background
Kuji is made by Tacit Labs Ltd. We are a company registered in England and Wales, number 17110976, with our registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ.
In this policy, "we", "us" and "our" mean Tacit Labs Ltd. We are responsible for the personal data described here, and for handling it in line with the law that applies to us.
We care about your privacy. Kuji is built to need as little of your information as possible. This policy explains what personal data is involved when you use Kuji, what we do and do not receive, and what choices you have.
The short version
| What stays on your phone | Everything you type. Your lists, the names in them, your results and your settings live in Kuji's private storage and we cannot read them |
| What we receive | Nothing, unless you switch it on. If you do, a small fixed set of labels and counts about how the app is used — never a name, never who won |
| What it costs you to say no | Nothing. Kuji works fully with every optional setting off, and picking is never behind a payment |
| Adverts | None inside Kuji |
| Accounts | None. There is nothing to sign up for and no profile for us to look you up in |
| The one thing that can carry names off your phone | Your own device backup, which belongs to you and which you control in your phone's settings |
The rest of this policy is the detail behind those six lines.
Some words we use: "Kuji" or "the app" means the Kuji application and everything shipped inside it. "Personal data" means information that relates to an identified or identifiable person. "Your device" means the phone or tablet you installed Kuji on. Where this policy says something happens "on your device", it means the information stays in Kuji's private storage on that device, and we cannot see it.
Our Cookie & SDK Notice goes with this policy. It describes the individual components inside the app one by one: what each sends, and what it never sends. The two are meant to be read together.
This policy applies to people using Kuji in the United Kingdom and in the European Economic Area. Where the two regimes differ — chiefly which regulator you can complain to, and how information reaching us from the EEA is protected when it travels — the difference is set out at the point it arises rather than in a separate document. If you are outside the UK and the EEA, the Rest of World version of this policy applies to you.
Our representative in the European Union is Euverify Ltd (Ireland), Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland, email gdpr@euverify.com, appointed under Article 27 of the EU GDPR because we offer Kuji to people in the Union. If you are in the EEA you may contact Euverify on any matter relating to how we handle your personal data, as an alternative to contacting us directly at the address in section 12.
Euverify also runs a secure portal, where you can both confirm that the appointment is genuine and send us a request directly: https://gdpr.euverify.com/verify/8a9baed8-ec1a-4658-a66a-1abedfbf6f4f.
2. The app we provide
Kuji is a fair picker. You put fingers on the screen, or type a list of names, and Kuji chooses a winner, splits teams, or settles an order at random. People use it for deciding who goes first, picking a volunteer, splitting a group into teams, and similar everyday decisions.
There is no account and no sign-up. You do not give us your name, your email address or any other contact details to use Kuji. There is nothing to log in to.
Kuji has no server of its own. Everything you do in the app happens on your device: every pick, every saved list, every setting.
Kuji is free to use. There is one optional purchase, Kuji Unsealed, which opens up extra options. Picking itself is never locked behind payment.
3. The types of information Kuji handles
On your device only
| What | What it holds |
|---|---|
| The lists you save | If you use the Names feature, the list name and the names of the people in it, plus any weighting or "keep these two apart" settings you have chosen. These names are personal data about the people you have named, who may be other people rather than you |
| Your recent results | A short history of recent picks, so you can look back at them. Without the paid unlock the app shows you fewer of them; the rest stay on your device until newer picks push them out or you clear the history. Where you picked from a list, the record includes the names of the winners or teams, and the time |
| Your settings | Your chosen appearance, sound and haptic settings, the picker options you last used, whether the calmer reduced-motion presentation is on, and whether you have bought the paid unlock |
| Your privacy choices | Which of the three optional settings (Usage data, Crash reports and Advertising measurement) you have turned on, and which version of our privacy prompt you last saw |
All of the above is held in Kuji's private storage on your device. We have no access to it. We cannot read it, copy it or recover it. There is no feature in Kuji that sends it to us.
Information we receive from the app
Kuji can send us usage information, crash reports, and advertising measurement information. These are the three settings labelled "Usage data", "Crash reports" and "Advertising measurement", both when the app first asks and in the menu afterwards, under Sharing.
This information carries no name and nothing you have typed, but it does include an identifier for your installation, so it identifies the installation rather than you.
All three are switched off when you install the app, and stay off unless you turn them on. The law in the UK and the EEA requires us to ask before collecting anything, and Kuji asks shortly after it first opens. Each is separate: turning one on does not turn on another. Section 4 explains what each contains.
Your device's own backup
Your device's operating system may include Kuji's on-device data in the backup it creates in your own cloud storage account. That covers your saved lists and your settings. Your recent results are not included: they are kept in a separate place on the phone that the backup does not copy. This is done by your device, not by Kuji.
That backup belongs to you, and is governed by your own platform account and its terms. We have no access to it. We cannot read it, and we cannot delete it for you. You control it through your device's backup settings, where you can also turn app backups off.
4. How we use information
The lists and personal names you put into Kuji stay on your device. We do not receive them, and they exist so that Kuji works the way you expect between one use and the next.
If you turn on any of the optional settings below, we do receive some information about how the app is used. That includes the shape of a pick and which settings you have changed. Each heading sets out what its setting covers.
Usage analytics
You choose whether this is on, and nothing is collected unless you turn it on.
If you do, we receive a small, fixed set of labels and counts: which features get used, how many people took part in a pick, how many winners or teams it produced, and which settings you have moved away from their default. The Cookie & SDK Notice lists exactly what is sent.
We use it to decide what to build next — in Kuji, and in other apps we make, including ones we have not released yet. The approximate location described below serves a further purpose: understanding how Kuji is performing area by area. It is a count per area, never an examination of any individual; it does not change what any user is shown, and it is not used to target advertising or shared with any advertiser.
It does not include the names on your lists, who or what won, or anything you have typed.
The analytics services also collect some information of their own: an identifier for your
installation, your app version, device model and operating system, how often you return, and your
device's internet (IP) address, which they use to work out an approximate location. That
location is derived down to a city and a postcode area — in the UK the outward code only, such
as SE8, and in some other countries the full postal code — along with the coordinates of that
city's centre. Kuji asks for no location permission and reads no location API, and neither
provider stores the address itself.
Two further labels are attached: whether you have bought the paid unlock, and which build of the app you are running. We use them to tell whether a problem or a pattern affects one group more than another.
Crash reports
You choose whether this is on, and nothing is collected unless you turn it on.
If you turn it on, then when Kuji stops unexpectedly we receive a technical report of what went wrong. That is the sequence of code that failed, your device model, your operating-system version, the app version, and an identifier for your installation.
We use it only to find and fix faults. It does not contain the names on your lists or anything else you have typed.
Advertising measurement
You choose whether this is on, and nothing is collected unless you turn it on.
If you turn it on, we can tell that you installed Kuji after seeing one of our adverts, and whether you later bought the paid unlock. An advertising partner tells us that much: for example, that an install came from a particular campaign.
This works using an advertising identifier your phone provides, plus information about the advert you tapped. The Cookie & SDK Notice lists exactly what each partner receives.
It does not include the names on your lists or what Kuji picked.
Our advertising partners use what they receive for their own purposes as well as ours, so their own privacy policies apply to it. The Cookie & SDK Notice names every partner we currently work with, and links to each one's policy.
Your phone's own settings let you reset or limit your advertising identifier, and Kuji treats that as an instruction in its own right: if your phone reports you have opted out of ads personalisation, we stop using the identifier and the partner software that reads it does not run, even if the switch above is still on. The other half of advertising measurement never uses that identifier, so a phone-level opt-out does not reach it — the switch above is what stops that. Section 10 covers turning the setting off.
Purchases
If you buy Kuji Unsealed, the purchase is handled by the app store, not by us. We do not see or receive your payment card, bank details or billing address.
Kuji asks the store whether the unlock has been bought on your account. It asks each time it starts and each time you return, for everyone, including people who have never bought anything. Section 7 sets out what that check carries.
Kuji records on your device that the unlock is active. Your purchase also has a store reference, which Kuji sends back to confirm the purchase went through; that is what stops the store cancelling it, and the exchange is between your device and the store. If you have Usage data on, Kuji keeps a copy of that reference. Once kept, the copy stays until you clear the app's data or uninstall Kuji. Turning Usage data off later stops another copy being kept but does not remove the one already there, and your device's backup does not copy it.
If you have turned on Advertising measurement, our advertising partners are also told that a purchase happened (see that setting above). They are never told your payment details, because we never have them.
Advertising
Kuji contains no adverts. No advertising software displays anything to you inside Kuji. If you turn on Advertising measurement, we measure which advert brought you to Kuji; we do not show you adverts inside it.
5. Why we are allowed to use your information
The law that applies is the UK GDPR if you are in the United Kingdom and the EU GDPR if you are in the European Economic Area. The two say the same thing about everything below; where a right or a route differs, this policy says so at that point.
| What we do | Legal basis | Why |
|---|---|---|
| Usage analytics | Your consent | It happens only because you turned Usage data on, and stops when you turn it off |
| Crash reports | Your consent | Same: Crash reports is off until you switch it on |
| Advertising measurement | Your consent | Same. We do not rely on "legitimate interests" for this |
| Checking whether you have bought the paid unlock | Performance of our contract with you | It is how we give you the version of the app you are entitled to. It is not optional and not covered by the settings above — see below and section 7 |
| Keeping a record of the privacy choices you made | Our legal obligation | We have to be able to show you were asked and what you answered |
Optional collection: your consent. We collect usage analytics, crash reports and advertising measurement only because you chose to turn them on.
You can withdraw that choice at any time in the app's menu, under Sharing. It takes effect immediately, and it is as easy to turn off as it was to turn on.
When you withdraw it, collection stops. What happens to information already on your device differs by setting:
- Usage data: the analytics data cached on your device is cleared, and the analytics identifier for your installation is replaced with a new one.
- Crash reports: any crash report not yet sent is deleted. The crash-reporting identifier for your installation is not replaced: it stays on your device until you clear the app's data or uninstall Kuji.
- Advertising measurement: nothing further is sent. The advertising identifier this uses belongs to your phone rather than to us, so you reset or limit it in your phone's own settings.
What a provider has already received is not deleted on the spot. It is held for the period in section 9.
Your purchase, and the app itself: performing our contract with you. Kuji asks the store whether the paid unlock has been bought on your account. It asks for everyone, every time it starts; that is how the unlock restores on a new phone without you proving anything. The legal basis is performance of a contract: installing Kuji means accepting our terms, and this check is how we give you the version of the app you are entitled to, whether that is the free one or the paid one. It is not one of the optional settings and it is not covered by them (see section 7).
We do not rely on any "legitimate interests" basis to collect information from your device. We do not profile you, and we do not make automated decisions about you. Our advertising partners do build advertising profiles. If you turn on Advertising measurement, what they receive feeds those profiles, under their own policies (see sections 4 and 6).
6. Who else sees your information
Kuji has no sharing feature, no sync, no upload and no backend. We do not hold your lists or your results, so there is no way for another person or company to obtain them from us.
| Who | What they get | In what capacity | Only if |
|---|---|---|---|
| Our analytics providers | The usage information described in section 4 | Processors — they act on our instructions, for our purposes only | You turn on Usage data |
| Our crash-reporting provider | The technical crash record described in section 4 | Processor | You turn on Crash reports |
| Our advertising partners | The install and purchase facts described in section 4 | In their own right, alongside us — they use it for their own purposes too | You turn on Advertising measurement |
| The app store | Your purchase | In its own right, as the seller | You buy the paid unlock |
| Your own cloud backup | Kuji's settings file, which contains your saved lists | It is yours, not ours; we cannot reach it | Backup is on in your device settings |
Each provider and partner is named in the Cookie & SDK Notice, with what it receives, what it never receives, how long it keeps it, and a link to its own policy.
Our advertising partners are in a different position. If you turn on Advertising measurement, what they receive is used for their own purposes as well as ours. Each of them is responsible for it in their own right, alongside us, rather than simply acting on our instructions, so what happens to it afterwards is governed by their policies, not only by this one.
With one of those partners, Meta, the first step is shared. Collecting this information on your device and sending it to Meta is a step we and Meta decide on together, so for that step the two of us are jointly responsible, and you can raise a question or make a request about it with either of us. What Meta does with the information afterwards is Meta's own decision, taken for Meta's own purposes. We and Meta have an agreement that sets out which of us answers for what.
If you buy Kuji Unsealed, the transaction is handled by the app store operator, which acts in its own right as the seller of record.
We do not sell your information, and we do not share it with data brokers.
Your own cloud backup can carry the names you type off your device, and it is described in section 3.
We may disclose information where we are legally required to do so, or to establish or defend legal claims. In practice we hold very little that could be disclosed.
7. Sending information outside the UK and the EEA
If you turn on any of the optional settings, some of that information is processed outside the country you are in. Where it is stored depends on the provider, and so does what that means for you.
One provider stores it in the European Union, in Germany. If you are in the EEA, that information stays inside the EEA while it is at rest. If you are in the United Kingdom, it has left the UK.
Where information rests is not the same as who can reach it. The German storage is a genuine protection, but it does not mean the information never goes to the United States — the provider is a US company, and the second route described below is what that creates. Read the two together.
The others store it in the United States, which is outside both the UK and the EEA wherever you are reading this.
Those are the places we know it goes, and not the limit of what our agreements allow. For at least one provider the agreement permits processing in any country where it or its own suppliers operate facilities, rather than naming a list we could hold it to.
There is a second route that applies to everyone. Our providers are, or answer to, United States companies, and our agreements with them allow access and support from the US — so even where information rests in Europe, it can be reached from outside it. We treat that as a transfer and cover it accordingly. The Cookie & SDK Notice records the position for each provider.
Where information leaves the UK or the EEA, we rely on the safeguards the law requires for that destination. For most of our providers that is a set of standard contractual terms built into our agreement with them — the UK International Data Transfer Addendum for information reaching us from the United Kingdom, and the European Commission's standard contractual clauses for information reaching us from the European Economic Area. Where a provider holds a recognised adequacy status instead, we rely on that. The Cookie & SDK Notice records which applies to each provider.
If you would like to see a copy of the safeguards that apply, contact us using the details in section 12.
If you leave the optional settings switched off, we receive no information about how you use Kuji, and nothing you have typed reaches us.
One exception is not covered by any switch. Kuji checks with the Google Play Store whether the paid unlock has been bought on your Google account. It does this when it starts, and when you return to it.
That check happens for everyone, including people who have never bought anything and never turned any setting on. It is how the app knows to restore your unlock on a new phone without asking you to prove a purchase.
It carries no names, no lists, no results and nothing you have typed. It asks the store what your account owns, nothing more. The exchange is between your device and Google Play under your own store account, and we do not receive it.
Your device's own cloud backup (see Your device's own backup in section 3) may be stored outside the UK or the EEA by your platform provider, under your own account terms. That is a matter between you and your platform provider.
8. How we safeguard your information
Most of what Kuji holds never leaves your device. Your lists, the names in them and your results stay there, unless your own device backup includes them.
Information on your device is held in Kuji's private storage, which other apps cannot read.
Where you have turned an optional setting on, the information is encrypted while it travels to the provider.
Until you turn one of those options on, the components behind them are not started at all. The one thing that runs regardless is the store entitlement check in section 7, which never reaches us.
No system can be guaranteed completely secure. We aim to hold as little of your personal data as possible.
9. How long information is kept
| What | Kept for |
|---|---|
| Your saved lists | Until you delete them, or clear the app's data. No time limit, and nothing is deleted automatically |
| Your recent results | Until newer picks push them out of the history, or you clear the history in the app |
| Your settings and privacy choices | Until you clear the app's data or uninstall Kuji |
| Usage analytics, if you turned it on | A period set with each provider, recorded per provider in the Cookie & SDK Notice |
| Crash reports, if you turned them on | As above, per provider, in the same notice |
| Advertising measurement, if you turned it on | A period set by each partner under its own terms, not by us. The same notice records what each says |
| Your device's backup | As long as your platform provider keeps it. We cannot delete it; you control it in your device's backup settings |
Two notes on the table.
On lists. On the free tier you can keep up to three. With the paid unlock there is no limit on how many you keep. Kuji nudges you to keep each list to about ten names, but that is a nudge about how the app looks, not a limit on what your device keeps, and a list saved before that nudge existed keeps everyone already in it.
On your privacy choices. They are deliberately kept when you use "reset to defaults", so that resetting your settings never silently turns collection back on.
Removing Kuji, or clearing its data in your device's settings, removes everything Kuji has stored on that device.
10. Your rights
You have rights over your personal data. You can ask us to confirm what we hold about you and give you a copy; correct it, if it is wrong; delete it; restrict or object to how we use it; or give it to you in a portable form. Where we rely on your consent, you can withdraw it at any time.
In practice, the fastest route is inside the app, because your lists, results and settings are held only on your device:
- delete a saved list, or a person in one, from Manage lists… in the app menu;
- clear your recent results with CLEAR in the The record pane of the app menu;
- turn off Usage data, Crash reports or Advertising measurement in the menu, under Sharing. This stops that collection immediately, and section 5 sets out what else each switch clears on your device. It does not delete what a provider or partner has already received; that is held for the periods in section 9;
- clear the app's data or uninstall Kuji to remove everything it has stored on the device.
Your phone's own settings also let you reset or limit your advertising identifier at any time, for every app at once, and Kuji honours that: once your phone reports you have opted out of ads personalisation, we stop using the identifier whatever the switch in the app says. Turning the switch off is what stops advertising measurement itself.
For anything you cannot do in the app, contact us using the details in section 12. We aim to acknowledge within 5 working days, and we will respond within one calendar month. If your request is complex, or you have made several, we may need up to two further months, and we will tell you within the first month if that is the case.
We cannot delete your device's own cloud backup. It sits in your platform account and we have no access to it. If you want that copy removed, you need to do it through your device's backup settings.
Kuji has no accounts, so we usually have no way to connect a request to a particular person's data, because there is no profile for us to look up. If you contact us, we may need to ask what exactly you are asking about, so that we can help.
If you are unhappy with how we have handled your personal data, you can complain to a regulator. We would appreciate the chance to put things right first.
| If you are in | Complain to |
|---|---|
| The United Kingdom | The Information Commissioner's Office, at ico.org.uk/make-a-complaint |
| The European Economic Area | The supervisory authority in the country where you live or work, or where you think the problem happened. The European Data Protection Board lists them at edpb.europa.eu/about-edpb/about-edpb/members_en. You may also raise the matter with our EU representative, Euverify Ltd, whose details are in section 1 |
We are not established in the European Union, so no single supervisory authority leads on our behalf. That means your own national authority is the right one to approach; you do not need to contact an authority in Ireland because our representative is there.
11. Children
Kuji is intended for people aged 13 and over, and it is not directed at children. It is used in classrooms and families, and these protections apply to everyone using it:
- Kuji collects nothing by default;
- there is no account, no profile and no social feature;
- nothing you type ever reaches us; it stays in Kuji's storage on your device, unless your own device backup includes it (see section 3);
- Kuji shows no adverts;
- every optional collection setting is off until somebody deliberately turns it on.
Advertising measurement is off until somebody turns it on, it is never bundled with another choice, and it sends no name, no result and nothing anyone has typed. Turning it on is a decision for an adult to make. Section 6 sets out who receives it and what they do with it.
Kuji is not for children under 13, and we do not knowingly collect personal data from a child under 13. If you are a parent or guardian and believe a child under 13 has used Kuji in a way that sent us information, contact us using the details in section 12. We will act to resolve what is reasonably possible. What is held on the device can be cleared there; what a provider already holds is deleted on the periods in section 9.
If you are under 18, please talk to a parent or guardian before turning on any of the optional settings. They are entirely optional, and Kuji works fully without them.
A note for teachers and group organisers. If you type other people's names into a saved list (your class, for example), those names are personal data about them, not about you.
They stay on your device and we never see them. But they may be included in your device's own backup (see Your device's own backup in section 3). It is worth keeping lists only as long as you need them, and Kuji makes deleting them a one-tap action.
12. Questions and concerns
If you have a question about this policy, or about how your personal data is handled, contact us:
Tacit Labs Ltd 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom privacy@tacitlabs.co.uk
If you are in the European Economic Area you may instead contact our Article 27 representative, Euverify Ltd. Their postal address, email address and secure request portal are in section 1. Any of these routes reaches us, and none is a precondition for the others.
13. Changes to this policy
We may update this policy when our practices change, when the technologies the app relies on change, or when the law that applies to us changes. The "last updated" date at the top always reflects the most recent version.
If we make a material change, for example if we begin collecting something new or use information for a new purpose, we will tell you in advance. That will be through a notice in the app, and where relevant through the app store listing, before the change takes effect.
A material change to what we collect, or to what we use it for, means we ask for your privacy choices again, rather than carrying an old answer forward onto something you did not agree to.
If you would rather not accept an updated policy, you can withdraw your consent at any time in the app's menu, or remove the app.