Klokito is a game where you tap a running clock. This page says what data the game uses, why, and what you can do about it. It follows the EU General Data Protection Regulation (GDPR), the UK GDPR, and gives the notices that other laws (for example the California CCPA) ask for.
The controller of your data is anomalymasters s. r. o., Trieda KVP 1C, 040 23 Košice, Slovakia, company ID (IČO) 57230099, VAT ID SK2122615968, registered in the Commercial Register of the Municipal Court Košice, section Sro, file 63569/V. E-mail: privacy@klokito.com. We have not appointed a data protection officer; the company is small and the processing is low risk.
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Guest ID: a random identifier the app creates and stores on your device | To keep your scores and progress between visits without an account | Contract (art. 6(1)(b)): running the game you asked for | Until you clear the app data or the guest is merged into an account |
| Taps: the server time of each tap, the distance to the whole second, points, bonuses, runs and duels | Scoring, leaderboards, fairness checks (the server measures network delay and removes it) | Contract | Daily, weekly and monthly leaderboards expire with their period. All-time totals, click histogram (10 ms buckets) and points per day (last 14 days) stay while your profile exists |
| Profile: display name, chosen nickname, level, streak, missions, theme, club membership | Progress, leaderboards, clubs | Contract | While your profile exists |
| Time zone offset sent by the app | Bonuses tied to your local time | Contract | Only during the connection; not stored |
| Account (only if you sign in): the identifier your identity provider gives us, your first name, and your e-mail address | To recognise you across devices and merge your guest progress into the account | Contract | While your account exists. We store the identifier and the first name; the e-mail is used during sign-in and is not kept on the game server |
| Subscription status (Klokito Plus): whether Plus is active and until when | To unlock Plus features | Contract | While your account exists |
| Technical data: IP address, browser type, request logs | Security, abuse prevention, keeping the service running | Legitimate interest (art. 6(1)(f)): protecting the service | Server logs are rotated within 30 days. Cloudflare keeps its own short-term security logs |
Your display name and scores are shown to other players on leaderboards. Choose a nickname if you do not want your first name shown. Nicknames are unique.
We do not build profiles for advertising, we do not sell personal data, and we do not use analytics or advertising trackers. We make no automated decisions with legal effect about you.
The app stores the guest ID, your session token and your theme in your browser's local storage (or the app's private storage on a phone). During sign-in the server sets one short-lived cookie (10 minutes) to protect the login against forgery, and the login service sets its own technical cookies. Our network provider Cloudflare may set technical cookies for security. All of these are strictly necessary, so no consent banner is shown. There are no advertising or analytics cookies.
We share data with authorities only when the law requires it.
You can ask us to: see the data we hold about you (access); correct it; delete it (erasure); restrict or object to the processing based on legitimate interest; and receive your data in a portable format. You can withdraw consent at any time where processing is based on consent. Write to privacy@klokito.com; we answer within one month.
To delete your account or guest profile, e-mail us the display name and, for accounts, the e-mail you signed in with. We delete the profile, scores, statistics and club membership within 30 days. Leaderboard entries that already expired are not recoverable anyway. Steps and what gets deleted: delete your account.
If you think we handle your data unlawfully, you can complain to the Slovak supervisory authority: Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk, or to the authority in the EU country where you live.
California residents: you have the right to know, delete and correct, and the right not to be discriminated against for using these rights. We do not sell or share personal information for cross-context behavioural advertising. Use the e-mail above.
Klokito is not directed at children under 16. Playing as a guest uses only a random identifier. If you are under 16 in the EU (or the age your country sets), do not sign in with an account without a parent's permission. If we learn that we hold account data of a child without permission, we delete it.
All traffic is encrypted with HTTPS. Session tokens are signed and expire after 30 days. Passwords are never stored by us: sign-in is done by the identity provider you choose.
When this policy changes, we update the date above and, for important changes, show a notice in the game.