Bloom Blocks for Android, by Kiki Games. Last updated: 8 November 2026.
DRAFT: prepared without a lawyer; have it reviewed before launch.
1. In short
- Bloom Blocks is a free game with ads and optional purchases. It is made by one person.
- You can play offline without any account. Your progress, coins and settings stay on your phone. There is no cloud save.
- The online features (leaderboards, awards, challenges) are for players aged 13 and over. If you tell the game you are under 13, the online features stay off and the game sends nothing to our server.
- If you use the online features, the game quietly creates a guest account with a random id and a generated name such as "Sunny Tulip 4821". We never ask for your real name, email, phone number, contacts, photos or precise location. There is no chat and no free-text name.
- Ads are shown by Google AdMob. For players under 13, ads are child-directed and not personalised. Elsewhere, where the law requires it, you are asked for consent first.
- We do not sell your personal data.
- You can delete and download your online data inside the game (Profile, then Delete data) or by email. See Delete my data.
2. Who we are
The data controller (in India: the "Data Fiduciary") is Lalit Kumar, trading as Kiki Games. I am an individual, not a company. Based in India. Contact: by email only (see below).
Contact for everything in this policy: hello@kikigames.net. Website: kikigames.net.
3. What we collect, why, and on what legal basis
"Legal basis" is the GDPR term (EEA, UK). Under India's Digital Personal Data Protection Act 2023 (DPDP Act) the equivalent is your consent or a "legitimate use". We give both in plain words. For the online account, your consent is your tap on the consent step in the game. You can undo it by deleting your data.
3.1 Data on your phone only (we never receive it)
Your game progress, coins, boosters, settings, the purchase ledger used to avoid paying you twice, and your answer to the age screen are stored in the game's private storage on your phone. Uninstalling the game removes them. We do not have a cloud save.
3.2 Online guest account (only if you use online features)
| Data | Why | Basis | Kept |
|---|---|---|---|
| Random player id and random install id; a signing key is derived from the install id on the server (only your phone and our server know it) | To recognise your phone and to protect the service from forged requests | Contract (providing the online features you use); legitimate interest (security) | While the account exists |
| Account created and last seen times; game build number; platform (for example "android") | Run the service, remove inactive accounts, fix problems per version | Contract; legitimate interest | While the account exists |
| Public profile: generated name, avatar number, level, stars, medals, daily streak, equipped title, and (only if our network provider supplies it) a two-letter country code | Show you on leaderboards and in your profile. Other players can see these items and nothing else about you. | Contract | While the account exists |
| Scores you submit (Daily and Endless boards): board, score, time submitted, game build and rules version, the random seed, play duration, and the move log (which piece went to which cell) | Leaderboards, and checking that a score is genuine before an award is paid | Contract; legitimate interest (fair play, preventing cheating) | Score: while the account exists. Move log: 90 days, then erased |
| Awards and challenge progress (what you won, claimed, when). Weekly awards follow weeks in Indian Standard Time (IST) | Pay each award once; weekly challenges | Contract | While the account exists |
| Safety flags (a counter of implausible score attempts) and a block or hide status, if we ever have to apply one | Keep leaderboards fair | Legitimate interest | While the account exists |
We create this account only after the age screen and the consent step, and never for a player who says they are under 13. Endless runs that use the flower pot are not ranked. Linking Google Play Games, recovery codes and email sign-in are not available. If we add them, we will update this policy first.
3.3 Technical data when the game talks to our server
| Data | Why | Basis | Kept |
|---|---|---|---|
| Your IP address (necessarily seen by the server and the network on every connection) | Limit request rates and block abuse. The server holds it only in memory for this; it is not written to our database or to our application log. | Legitimate interest (security) | Minutes, in memory |
| One-time request numbers and replay-protection records | Stop a captured request being replayed | Legitimate interest | 10 minutes; request answers kept 24 hours; challenge progress events 8 days |
| Application log line per request: request id, route, result code, duration, and your player id | Find and fix errors | Legitimate interest | Rotated weekly; the newest 8 weeks are kept |
| Daily counters (requests, registrations, errors) with no player id | Know that the service works | Legitimate interest | 400 days |
| Operator audit trail (what an administrator did, with a shortened one-way hash of the id, no readable identifiers) | Accountability for support and moderation actions | Legitimate interest | While the service runs |
| Deletion record (time and reason, no identifiers) | Show that deletions happen | Legitimate interest; legal obligation | While the service runs |
| Nightly database backups | Recover from a failure | Legitimate interest | The newest 14 backups are kept on the server, so deleted data leaves them within about 14 days. Any private copy I keep off the server is deleted within 30 days. |
Our web server does not keep access logs. Our hosting provider may process connection data on its network under its own terms.
We use no cookies and no web trackers. This website sends no requests to other sites.
3.4 Ads (Google AdMob and Google's consent form)
The game shows rewarded video ads (you choose to watch) and interstitial ads between levels. Ads are served by Google AdMob. When an ad is requested, Google's software in the game collects and uses, for advertising, analytics and fraud prevention: your advertising ID (and app-set ID), IP address (which gives a rough location), interactions with ads, and diagnostic information about the ad software. Google decides how this data is used and is an independent controller for that use. See Google's advertising technologies and Google's privacy policy.
- Players under 13. Ads are shown to everyone, including players who say they are under 13. For those players the game tells AdMob to treat the ads as child-directed. Only family-safe ads are requested and ads are not personalised. We do not use the advertising ID for them.
- Consent (EEA, UK, Switzerland and where required). Google's User Messaging Platform form asks for your choice before ads are requested. You can reopen it at any time from the game's settings (Ad choices). Basis: your consent.
- Elsewhere (including India), ads follow Google's own rules and your Android ad settings.
- Your controls. On Android: Settings, Privacy, Ads: delete your advertising ID or opt out of ad personalisation. You can also buy "Remove Ads", which stops interstitial ads. Rewarded ads stay available by choice.
3.5 Purchases (Google Play Billing)
Purchases of "Remove Ads" and coin packs are handled entirely by Google Play. We never see your card or payment details. The game receives a purchase confirmation and a purchase token from Google Play, which it stores on your phone to deliver what you bought once and to restore it. Our online server receives nothing about purchases. Basis: contract.
4. What we do not do
- We do not sell personal data, and we do not share it for cross-context behavioural advertising, except that Google AdMob collects ad data itself through its software in the game (section 3.4).
- We do not collect your name, email, phone number, address, contacts, photos, microphone, camera or precise location.
- We do not run profiling or automated decisions that have legal effects on you. Automated checks only reject implausible scores and rate-limit abusive traffic.
- We do not use your data to train AI systems.
5. Who receives data (processors and partners)
| Who | What | Role |
|---|---|---|
| AIC Cloud / OVH (virtual server provider), region US-BHS, Beauharnois, Canada | Hosts our server and database, so it holds all data in sections 3.2 and 3.3 | Processor (hosting) |
| Cloudflare | DNS for kikigames.net (answers "where is the server?"). It sees DNS lookups for our domain. Traffic to the game server does not pass through Cloudflare. If that changes, we will update this row. | Processor (DNS) |
| Google (AdMob and User Messaging Platform) | Ads and the consent form: section 3.4 | Independent controller for ad use; processor for the consent form |
| Google Play (store and Billing) | Installing the game, purchases: section 3.5 | Independent controller |
| ntfy.sh | We use it only to send the operator "server is down" alerts. These messages contain no personal data. | Not a recipient of player data |
We may disclose data if the law or a valid legal order requires it, or to protect the safety of the service and people.
6. International transfers
Our server and database are in Canada. The developer is in India. If you play from the EEA, UK, India or elsewhere, your online data is therefore transferred to Canada and read from India. Where the law requires a safeguard, we rely on the tool that fits: an adequacy decision where one covers the transfer, otherwise standard contractual clauses in our hosting provider's terms. India's DPDP Act allows transfers unless the government restricts a country. Google may process ad data in other countries under its own terms.
7. How long we keep data
- Guest accounts with no activity for 12 months are deleted automatically with all their scores, awards and progress.
- Move logs: erased 90 days after the score was submitted.
- Technical records: see the "Kept" column above (minutes to 400 days).
- When you delete your online data, the account disappears from the live database at once. Server backups rotate out within about 14 days. A private off-server copy, if any, is deleted within 30 days.
8. Your rights
Whatever country you live in, you can:
- Access and export: in the game (Profile, Download data) you get one file with everything in the online account. Or email us.
- Delete: in the game (Profile, Delete data), or by email. See Delete my data.
- Correct: you can re-roll your generated name and change your avatar in the game. Other items are produced by the game itself.
- Withdraw consent at any time: reopen the ad consent form, reset your advertising ID in Android, or delete your online data. Withdrawing does not affect what happened before.
- Object or restrict processing based on legitimate interest, and ask for a copy in a portable format (the export is JSON).
We answer within 30 days. You do not pay for this. We may ask one question to check that an account is yours.
EEA and UK (GDPR, UK GDPR)
You also have the right to complain to your local data protection authority. Using a guest id is voluntary, but without it the online features cannot work.
California and other US states (CCPA/CPRA and similar laws)
We do not sell personal information, and we do not share it for cross-context behavioural advertising, except for the ad data Google AdMob collects itself (section 3.4); you can limit that in your Android ad settings. You may ask us what we hold, to delete it, or to correct it, and we will not treat you worse for asking. Use the contact below. An authorised agent may ask on your behalf.
India (DPDP Act 2023)
You may give or withdraw consent, access a summary of your data, correct or erase it, nominate another person to exercise your rights if you die or cannot act, and use our grievance redressal first. If we do not resolve your complaint, you may approach the Data Protection Board of India. The game uses a single 13+ rule. If you are under 18 and live in India, please use the online features only with the permission of a parent or guardian.
Grievance Officer (India): Lalit Kumar (the owner of Kiki Games, an individual), email hello@kikigames.net. We acknowledge a complaint within 3 working days and aim to resolve it within 30 days.
9. Children
Online features are for ages 13 and over. At first start a neutral age screen asks for your age or age range without hinting at a "right" answer. If you say you are under 13:
- the online features stay off, no online account is created and nothing is sent to our server;
- the game still works offline and may show ads, which are child-directed, family-safe and not personalised (section 3.4);
- we do not knowingly collect personal information from children under 13.
If we learn that a child under 13 has an online account, we delete it. Parents who think their child has an account can email us. This follows the principles of COPPA (US) and Google Play's family rules.
10. Security
- All traffic between the game and our server uses HTTPS (TLS).
- Every request from the game is signed with a key only your phone and the server know. Replayed or forged requests are refused. Requests are rate-limited.
- No passwords or emails exist to be stolen. Recovery codes, if added later, will be stored only as one-way hashes.
- The database is not reachable from the internet. Administrator access needs a long secret token, with lock-out after failed tries. Server access is by SSH key only.
- Daily backups are tested by restoring them.
No system is perfectly secure. If a breach affects your data, we will tell the people affected and the authorities as the law requires (for example within 72 hours under the GDPR, and the Data Protection Board of India under the DPDP Act).
11. Changes
If we change this policy in a way that matters, we change the date above, and for big changes (for example a new kind of data) we tell you in the game before the change applies. Older versions are available on request.
12. Contact
Lalit Kumar, trading as Kiki Games, India. Email hello@kikigames.net. Website kikigames.net.