Kozel Privacy Policy

Revised on 29 October 2026. This policy applies from the publication of this revision on the app's official page.

About the app and contact details

Kozel is a card game for iOS. This policy explains what data is used in the app, online rooms, voice chat and support, who receives it and how to request its deletion.

Roman Isakov, an individual, is responsible for processing data and is referred to below as the “controller” or “we”. The country of operation for the app is Thailand. Mailing address: 61/69, Soi 2, Mana Kathu Lake, Kathu, Phuket 83120, Thailand. For privacy, data access and deletion requests, as well as support, reports and bans, write to support@kozliniy.top. Additional ways to contact us are described on the support portal.

You do not need to register with a phone number or email address to play. The app does not use data for advertising, tracking across other companies' apps and websites or sale to data brokers. The absence of registration does not mean complete anonymity: random identifiers allow installations and participants to be distinguished and reports to be handled.

Why data is needed

We use data to save games and settings on your device, run online games and restore connections, deliver messages and voice to selected participants, deliver feature settings, prevent abuse, review reports and respond to requests. Technical information is also needed for troubleshooting, security and service recovery from backups. Action analytics helps us assess tutorials, interface usability, game mode choices and player retention.

Data needed for the game features you choose is processed to provide those features. Protecting the service, investigating violations and necessary diagnostics serve the legitimate interests of the controller and participants, taking your rights into account. Certain information may be retained to meet applicable legal obligations and handle legal claims. Where consent is required for particular processing, that processing must be based on such consent; iOS microphone permission alone does not replace consent required by law.

What is stored on your device

Settings, tutorial progress and saved games with bots are stored on your device. They may be included in iOS system backups depending on your settings.

To let you return to an online room, the app stores room and participant identifiers, a secret access token and an unconfirmed game action in the secure iOS Keychain. A separate random installation identifier is used for online protection, reports and support. It is not an advertising identifier or a phone number. Keychain entries may remain after the app is deleted.

A technical log is also kept on your device: interface events, network operation results and the card history of completed deals, including other participants' actions. In versions with analytics, the log also contains analytics events, including the full text of messages sent by the user of that installation. Unsent draft text, audio and secret tokens are not recorded. The full technical log is not automatically uploaded to the server; individual analytics events are sent to PostHog Cloud as described below. If you tap “Share”, the selected file is received by the recipient you choose to send it to; that recipient retains a separate copy.

Online play and data visibility

The game server receives your chosen name, room and participant identifiers, connection information, game actions and results. The access token is checked against its hash. The installation identifier is sent for protection and moderation features.

Other room participants can see your game name, seat at the table, availability, public actions and results. Hidden cards are revealed only according to the game rules; a deal's card history becomes available after its normal completion. Your installation identifier and secret token are not shown to other players.

The server stores room state and related operational records to run the game, restore connections and prevent actions from being executed more than once. Leaving a room does not mean these records are deleted immediately.

Messages, reports and bans

Ordinary chat messages and emoji are delivered to participants in real time. The game server does not archive ordinary conversations or restore their history. Separately, in versions with analytics, messages sent by a user are saved in that user's local log and sent to PostHog Cloud with the send event; this is not a chat history feature for other players. When reporting is available, the app temporarily keeps messages from the last 10 minutes in memory: up to 10 messages from each of no more than four participants. The buffer is cleared as messages expire and when rooms change; a report awaiting a retry is not saved to disk.

When a report is submitted, the server receives and stores the reason, an indication of a voice chat violation, selected quotes with timestamps, the name and identifier of the reported participant, room, participant and installation identifiers where available, and operational information to prevent duplicates. Quotes are supplied by the person submitting the report: they are not a server-verified transcript. No audio recording is attached to a report.

If Telegram moderation is connected, a bot sends the report number, room code, participant name, reason, voice violation indication and quotes with timestamps to a private moderators' chat. The installation identifier and secret token are not included in that message. Deleting a report from the game database does not automatically delete its copies in Telegram or copies saved by moderators. Such copies require separate handling when deletion is requested.

To prevent repeated violations, the server may retain a separate minimal record of an installation ban. Deleting a report does not itself lift a ban; you can request a ban review through support.

Voice chat

LiveKit Cloud is used for voice. After iOS microphone permission is granted, the microphone input stays on while you are in a room's voice chat, and iOS shows its microphone indicator. This keeps other participants' voices sounding the same whether your microphone is on or off. Until you enable the microphone in the app, its audio is muted on the device and not transmitted. Microphone access is not needed to listen to other participants. A voice session may continue in the background. You can turn off the microphone in the app or deny access in iOS settings.

LiveKit receives transmitted audio, your game name, room and participant or connection identifiers, IP address and technical information needed for communication and diagnostics. The game server does not receive audio. The app does not enable voice recording, speech recognition or voice agents. Transmission is encrypted; additional end-to-end encryption between participants is not enabled.

Under LiveKit's published data processing terms, communication content is deleted after delivery unless recording or logging is enabled or the law requires otherwise. The default period stated for observability data is up to 30 days, with up to another 30 days for backups; for technical telemetry, it is up to 60 days. Exceptions apply for billing, investigating violations and meeting legal obligations. Observability data relates to separately enabled LiveKit features; these periods do not mean that the app records conversations. You can ask support for details about data from a particular voice session.

Firebase remote settings

Google Firebase Remote Config delivers app feature settings. The service uses its own Firebase installation identifier, separate from Kozel's identifier, and technical parameters of the app and SDK, operating system, language, time zone and country. The SDK also sends operational diagnostics; Google uses some information in aggregate to analyze SDK operation.

Firebase Analytics, Crashlytics, the advertising identifier and Remote Config personalization are not connected in the app's current configuration.

According to the Firebase documentation, the Remote Config identifier is retained until its deletion is requested. After such a request, associated data is deleted from live and backup systems within 180 days. If you continue using remote settings, Firebase may create a new identifier that is not linked to the deleted one.

PostHog Cloud action analytics

In app versions with analytics connected, we use PostHog Cloud in the US Cloud region (United States). The app automatically sends events for meaningful actions: screen openings, available taps, tutorial steps, intermediate choices of answers and your own cards, hints, game actions, settings changes, chat and emoji. This collection does not include screen recording, audio, empty taps, taps on unavailable buttons, scrolling or finger movement paths. For chat drafts, editing events are recorded without their text; for sent messages, the full text is recorded.

An event may include its time and sequence, a random analytics installation identifier, a session identifier, app version and build, language, screen, game mode and difficulty, settings and game context available to the user. The analytics identifier differs from the advertising identifier, Firebase identifier and online room protection identifier. It allows actions and return visits from one installation to be linked. Secret tokens, passwords, the random seed for a deal and other players' hidden cards are not sent to analytics. As the recipient of an HTTPS request, PostHog also receives technical connection information, including the IP address. The app does not request geolocation for this analytics.

Before transmission, events are stored in a separate local queue and sent in batches. Without a network connection, the queue survives app closure and the next launch. After receipt is acknowledged, the corresponding records are removed from the queue; this does not delete them from the local log or PostHog. Erroneous records may be kept separately for diagnostics. The queue is excluded from app backups and has a size limit; new events may not be saved if space runs out.

Local games with bots may also generate and transmit analytics events. Analytics is not used for advertising, combining data with other apps or websites, or recording voice chat. Provider and processing information: PostHog privacy, Data processing agreement.

Support requests

If you write to us, we receive your sender address, request text and attachments you choose to send, such as a screenshot or exported log. This information is used to reply, investigate the problem and handle the request. Support email is hosted by Zoho Mail; your own email service also takes part in delivering the message.

The support portal is hosted on ChatGPT Sites (OpenAI). When you open the page, the hosting provider receives technical request information, such as the IP address and time. The app may add the version, build number and installation identifier to the part of the link after #. This is processed in the browser and is not included in the HTTP request to the hosting provider. Opening the portal alone does not submit a support request.

Who else receives data

The controller and authorized moderators have access to data within the scope of their tasks. The following providers are used to operate the service:

Railway. Game server, PostgreSQL and backups: room state, reports, bans and technical service information.

LiveKit Cloud. Voice transmission and technical connection information.

Google Firebase. Remote settings, Firebase identifier and SDK operational diagnostics.

PostHog Cloud (US Cloud). Analytics events, associated context and sent message text described in the analytics section.

Telegram. Copies of reports for moderation when the integration is connected; operational failure notifications.

Zoho Mail. Emails and attachments sent to support.

OpenAI / ChatGPT Sites. Hosting of the support portal and technical information about visits to it.

Cloudflare. Service availability checks and operational monitoring events.

We require the third-party service providers listed above, under their applicable service and data-protection terms, to protect user data at least as well as described in this policy and to process it only for the purposes stated here.

Operational failure notifications contain the event code, time, environment and an operational link, depending on the notification source. Standard templates do not include player names, cards, chat text or access tokens.

Other players, recipients of files you send and your email service receive information in the cases described above. Copies held by other players and your chosen recipients cannot be managed from the app.

Providers may process data outside Thailand and your country of residence. The processing location depends on the service used and its infrastructure; not all data is necessarily located in one country. Processing and international transfer terms are described in the respective providers' documents. You can request information about transfers of your data and applicable safeguards from the controller through support. Naming Thailand as the controller's country of operation does not limit mandatory rights granted to you by applicable law.

Retention periods

Settings, tutorials and local saves. On the device until deleted using the app or iOS; system backups are managed separately.

Installation identifier and room return data. In Keychain with no fixed period; they may survive app deletion.

On-device analytics queue. Unacknowledged events are kept until successful transmission or deletion of app data. There is no automatic age-based deletion for records isolated after an error. The total queue payload is limited to 50 MiB; database files may take additional operational space.

Events in PostHog Cloud. On the selected free plan, the provider states one year of event retention. Moving to another plan may change this period and is reflected in the current policy. This is not a promise of immediate deletion of all infrastructure copies on a particular date; deletion requests are handled separately. Retention terms by plan.

Local technical log. Old logs are cleared while the app is running after 7 days or when the total size reaches 50 MiB; the current session and active export are retained until completion.

Online rooms and related records. Expire 24 hours after creation, state change or successful connection restoration; activity may extend this period. For a paused room, the period is 24 hours from the start of the pause.

Reports, delivery queue and related decisions in the game database. 90 days from receipt of the report; Telegram copies and support correspondence are stored separately.

Minimal installation ban record. Until explicitly unbanned, separately from report quotes.

Remote Config identifier and associated data. Until deletion is requested; then up to 180 days for deletion in Firebase systems.

Room cleanup runs once a minute in batches of up to 200 rooms, so actual deletion may occur after expiry. Reports are also deleted in successive cleanup passes. Local logs are not cleared while the app is not running.

The service uses encrypted backups of the game database. The cleanup job is configured to delete its own copies older than 7 days after a new copy is created and verified, retaining the current copy and the newest copy found. If the job fails or no fresh copies are available, the period may increase. A record deleted from the live database may therefore remain in a backup for some time; room and report retention periods do not guarantee simultaneous deletion of all copies.

Report copies in Telegram. The retention rule for the controller and authorized moderators is no more than 90 days from receipt of the report. Copies must be deleted manually at the end of this period, or earlier upon a justified request, unless retention is necessary to investigate a violation, resolve a dispute or comply with the law. If an exception applies, only the necessary information is retained for as long as the grounds exist. Deletion from the game database does not trigger deletion in Telegram; the latter is checked separately. This does not mean automatic cleanup is configured in Telegram.

Support correspondence and attachments. The retention rule is until the request is resolved and no more than 90 days after that. The controller then manually deletes emails, attachments and working copies, except for correspondence necessary for an unresolved dispute or applicable legal requirement. Do not send support information that would allow other people to access a room or account.

Infrastructure logs may contain the IP address, time, client version, session identifiers and error information. Their retention and backup deletion periods are determined by the particular service, its settings and terms. The controller's manual rules do not change providers' technical retention periods. You can ask support for information about available periods and limitations.

Your choices and deletion requests

You can play with bots without joining an online room; this alone does not disable Firebase remote settings requests or PostHog analytics in versions where it is connected. You can choose not to enable the microphone, send requests or share the log. Microphone access can be revoked in iOS settings.

Depending on applicable law, you may request processing information and access to your data, its correction or deletion, restriction of processing, object to processing, withdraw consent where processing is based on consent, and contact a competent data protection authority. To contact the controller, use support@kozliniy.top.

In the app, open “Settings → Privacy” and prepare a deletion request. The text is created on your device: you can review it and send it to support through your chosen email service. Preparing the text and tapping “Share” do not in themselves mean that support has received an email.

Use the subject “Data deletion” and include the installation identifier, last available Firebase identifier and analytics identifier if shown, room code or report number, approximate date and the data you want deleted. If identifiers are unavailable, describe the circumstances. Do not send the secret room token, password or other access credentials.

The controller reviews requests manually. They clarify the scope and verify the requester's connection to the installation or request, then identify the relevant records in the game database, reports, Telegram, PostHog and support. A public name or room code alone is not enough for deletion. A request concerning a shared room does not entitle you to obtain or delete other people's data.

After verification, the controller arranges the necessary deletion or anonymization of records available to them, handles report copies and support attachments separately, and requests action from the relevant provider where necessary. Preparing a request in the app does not automatically delete data. A safe way to handle a shared room is determined with regard to the game state and other participants' rights.

In their response, the controller explains the result, remaining steps and limitations. If information must be retained under applicable law, to resolve a dispute or protect against abuse, they explain what is retained and on what grounds; this is not considered complete deletion. Response and fulfillment times are determined by applicable law. If the request needs clarification or action from a provider is pending, the controller informs you; this does not override mandatory deadlines. Data deletion does not automatically lift a ban.

Deleting the app does not send a request to delete server, Firebase or PostHog data and does not guarantee Keychain cleanup. iOS backups, messages held by other players and files held by your chosen recipients require separate action. A record may remain in a server backup until that backup is cleared; if such a backup is restored, the controller must reapply previously completed deletions before returning the data to normal use. Limitations on deletion in providers' systems are communicated separately.

Current policy version

The app checks the server version when you open “Privacy” and when you refresh manually. Without a connection, the last saved version is displayed, or the bundled copy if none has been saved; the source is shown on screen. The server text can be updated without a new app release.

The revision date changes when the policy is updated. The manual rules described here do not claim that automated deletion exists or that its execution has been verified across all systems. Text changes do not limit your mandatory rights under applicable law.