Okiko Privacy Policy
Effective date: 1 November 2026
This policy explains what personal data the game Okiko: Tic Tac Toe Online ("Okiko", "the app") collects, why, who we share it with, how long we keep it, and the choices and rights you have. It applies to the app on iOS and Android and to our support channels.
1. Who we are
The app is published by Yousef Kadah, an individual developer based in Israel ("we", "us"). On Google Play the developer is shown as KadahTech, and on the App Store as Youseif Kadah. Postal address: PO Box 545, Kafr Manda, Israel. We are the controller of the personal data described here.
For privacy questions and requests, email yousefkadah@gmail.com.
2. The short version
- You can play as a guest without giving us your name or email address.
- Other players see only your player name, avatar, score and match stats, never your email address or real name.
- We don't access your contacts, photos, camera, microphone or precise location, and the game has no chat.
- The free game shows one banner ad on menu screens. Where the law requires it, we ask for your consent before ads use your data, and you can change your choice at any time.
- You can delete your account and data in the app at any time: Settings → Delete account.
3. What we collect and why
3.1 Account data
| Data | When | Why |
|---|---|---|
| A random user ID | Always, including guest play | To identify your game account. |
| Email address and password | If you sign in with email | To sign you in and reset your password. Our authentication provider stores the password in hashed form. |
| Email address, name and account identifier from Google | If you sign in with Google | To sign you in. We never use this name or email as your player name. |
| Account identifier from Apple | If you sign in with Apple | To sign you in. We don't ask Apple for your name or email address. |
| Sign-in method and account creation date | Always | To run your account. |
3.2 Profile and gameplay data
| Data | Why |
|---|---|
| Player name (randomly generated, for example "Brave Seal 42", or one you choose) and avatar choice (one of our preset pictures) | To show you to other players. Names you choose go through an offensive-word filter. |
| Coin balance, score, matches played and won, rank | To run the game economy and the leaderboard. |
| Online match records: the board, players' IDs, names and avatars, result, timestamps | To run matches, decide results fairly and pay rewards exactly once. |
| Match history: result, coins earned, opponent's ID, board size, how the match ended, time | To show your history. |
| Private room codes you created, active matches, rematch requests | To run rooms and rematches. |
| Daily reward state (last claim day, streak) | To give one reward per day. |
| Owned and equipped skins, Remove Ads entitlement | To give you what you earned or bought. |
3.3 Purchases
When you buy coins or Remove Ads, we store the product ID, order ID, store transaction ID or purchase token, the coins credited and the time. We use these to credit each purchase exactly once and to restore Remove Ads. Payment is handled by Apple or Google. We never receive your card or bank details.
3.4 Safety data
| Data | Why |
|---|---|
| Players you block | To hide them from your leaderboard and never match you with them. |
| Reports you file: the reported player's ID, the reason, where it happened (leaderboard or match), the match ID and the time | To review abuse and act on it (section 9). Only our moderators can read reports. |
3.5 Device and technical data
- Settings stored only on your device: language, music, sound effects, haptics, and the counters that limit how often we ask for a rating. We don't receive them.
- App integrity checks: Firebase App Check uses Google Play Integrity on Android and Apple App Attest or DeviceCheck on iOS. These confirm that requests come from a genuine copy of the app, to protect the game against cheating and abuse.
- Connection data: our service providers process your IP address, device and app version and similar technical data to deliver the service and keep it secure.
3.6 Advertising data
When the app shows you ads, Google AdMob collects the following, for advertising, ad measurement and fraud prevention:
- device and advertising identifiers (the Android advertising ID, or on iOS the advertising identifier only if you allow tracking);
- your IP address, which can indicate your approximate location;
- information about the ads you see and tap;
- diagnostic data.
Section 6 explains your choices. See also how Google uses information from apps that use its services: https://policies.google.com/technologies/partner-sites.
3.7 Support
If you email us, we receive your email address and whatever you include in the message. We use it to answer you.
What we don't collect
Precise location, contacts, photos or videos, camera or microphone access, health data, browsing history outside the app, or chat messages. The game has no chat and no photo upload.
4. Legal bases (EEA, UK and similar laws)
| Purpose | Legal basis |
|---|---|
| Providing the game, your account, matches, rewards and purchases | Performance of our contract with you (the Terms of Use) |
| Security, fraud and cheating prevention, moderation, app integrity checks | Our legitimate interest in a fair and safe game |
| Personalized ads, and storing or reading information on your device for ads | Your consent, which you can withdraw at any time |
| Non-personalized ads | Our legitimate interest in funding the free game, and your consent where the law requires it for device storage |
| Keeping records required by law (for example tax records of purchases) | Legal obligation |
| Answering support requests | Our legitimate interest, or steps at your request |
5. Who can see your data, and who we share it with
Other players see your player name, avatar, score, rank and match stats on the leaderboard and in matches. They never see your email address or sign-in account.
Service providers process data for us under data-processing terms:
- Google: Firebase Authentication (your sign-in account, processed by Google in the United States), Firebase Realtime Database (where game data is stored, in the European Union: Belgium, region europe-west1), Firebase App Check, Google Play Billing and Google Sign-In. https://firebase.google.com/support/privacy · https://policies.google.com/privacy
- Apple: Sign in with Apple, App Store payments, App Attest and DeviceCheck. https://www.apple.com/legal/privacy/
- Google AdMob, for ads and consent management. For personalized ads, Google acts as an independent controller.
We may also disclose data when the law requires it, to protect players' safety or our rights, or as part of a business transfer. Whoever acquires the game then remains bound by this policy.
We don't sell your personal data for money. Some US state laws treat personalized (cross-context behavioral) advertising as "selling" or "sharing". You can opt out at any time in Settings → Privacy choices.
6. Your choices
- Player name and avatar: change them any time in your profile.
- Blocking: block any player from the leaderboard or after a match.
- Ad consent: the consent form appears on first launch where the law requires it. Change your choice in Settings → Privacy choices.
- Tracking on iOS: the app asks for permission only after the consent step. You can change it in iOS Settings → Privacy & Security → Tracking.
- Android advertising ID: reset or delete it in Android Settings → Privacy → Ads, or in Google settings.
- Remove Ads: a one-time purchase that turns off the banner.
7. How long we keep data
| Data | How long |
|---|---|
| Account, profile, coins, skins, purchases, rewards, history, blocks | Until you delete your account. |
| Reports you filed | Until we've handled them, and no longer than your account exists. |
| Finished online matches | They stay in the database without your name or avatar after you delete your account. They then contain only a random ID that no longer points to any account. |
| Backups | We don't keep separate backups. Deleted data is removed from the live database immediately. |
| Support emails | 24 months after the conversation ends. |
| Moderation decisions log | 24 months, to handle complaints and legal requests. |
Apple and Google keep their own records of your purchases under their own policies.
8. Deleting your account
In the app: Settings → Delete account, then confirm. You may need to sign in again. We delete:
- your profile, player name and avatar choice, coins, stats, rewards, skins, entitlements and purchase records;
- your match history;
- the reports you filed;
- your open rooms and lobbies;
- your sign-in account.
We also revoke the app's access to your Apple ID if you used Sign in with Apple. Finished matches keep only an anonymous record.
- Without the app: follow the steps on our account deletion page, or email yousefkadah@gmail.com from the address you sign in with (email or Google). We complete verified requests within 30 days. Guest and Sign in with Apple accounts aren't linked to an email address we can check, so please delete them in the app.
Deleting your account forfeits your coins and skins. A Remove Ads purchase belongs to your App Store or Google Play account, so you can restore it later with "Restore purchases".
9. Moderation
Player names are filtered automatically. Reports are reviewed by our team. We may rename players with offensive names, and suspend or close accounts that break the Terms of Use. We keep a short log of moderation decisions so we can explain them and handle complaints.
10. International transfers
We're based in Israel. Game data is stored in the European Union (Belgium). Your sign-in account is processed by Google in the United States, and our providers may also process data in other countries outside your own. Where the law requires it, transfers rely on adequacy decisions (the European Commission and the UK recognize Israel as providing adequate protection, and Google is certified under the EU–US Data Privacy Framework and its UK extension) or on the European Commission's Standard Contractual Clauses.
11. Security
Data travels encrypted (HTTPS/TLS). Database access rules let each player write only their own data and the matches they take part in. App integrity checks block unofficial clients, and only a small team can access the admin console. No system is perfectly secure; if a breach affects you, we'll notify you and the authorities as the law requires.
12. Children
Okiko is meant for players aged 13 and over and is not directed at children. We don't knowingly collect personal data from children under 13, or under the minimum age set by the law in your country. If you believe a child has given us personal data, contact yousefkadah@gmail.com and we'll delete it.
13. Your rights
Depending on where you live (for example under the GDPR, UK GDPR, Israel's Privacy Protection Law, US state privacy laws, Brazil's LGPD or Türkiye's KVKK), you may have the right to:
- access your data and get a copy, or have it transferred to another provider;
- correct it (you can rename yourself in the app);
- delete it (section 8);
- restrict or object to processing, including processing based on legitimate interests;
- withdraw consent at any time, without affecting earlier processing;
- opt out of "sales" or "sharing" for targeted advertising, and not be discriminated against for using these rights.
To make a request, email yousefkadah@gmail.com. We'll answer within the time the law sets (for example one month under the GDPR), and may ask you to confirm that the account is yours. You can also complain to your local data-protection authority. In the EEA, that's the authority where you live or work. In Israel, it's the Privacy Protection Authority.
14. Changes to this policy
We'll post any update here with a new effective date. If the changes are significant, we'll tell you in the app before they apply.
15. Contact
Yousef Kadah (KadahTech on Google Play, Youseif Kadah on the App Store)
PO Box 545, Kafr Manda, Israel
Email: yousefkadah@gmail.com