Effective date: October 19, 2026 · Version: 1 (in-app consent version consent_version 2)
Kubi: One Block Island ("Kubi", "the game") is a game designed for children aged 6–9. This policy explains what data the game handles and why, how long it is kept, and your rights as a parent. In short:
- No ads. No third-party analytics, tracking or SDKs. In online mode, only if the parent separately turns them on and only to improve the game, a few gameplay stats are kept on our own server: numbers kept under the game's random account (pseudonymous: no name, e-mail or location; play time, progress and crafting counts; no text). They are off until the parent chooses yes, and the parent can turn them off again (see Section 3). The only purchase is the optional Kubi Club subscription: only a parent can buy it, from the parent panel behind the parental gate; Apple / Google take the payment and we never see or store payment details (see section 2).
- Single-player sends no data at all. The island is stored only on your device.
- Online features (cloud backup, invite codes, visiting a friend's island) are off by default and can only be turned on by a parent, behind the parent gate.
- Children cannot type free text anywhere. There is no chat, voice, camera or location. The nickname is two words picked from a preset list.
- We do not sell, rent or share data with anyone.
1. Who we are (operator / data controller)#
| Publisher | Fatih Durmaz |
|---|---|
| Email (privacy and parent requests) | destek@kubioneblock.com |
| Web | https://kubioneblock.com |
Fatih Durmaz is the only operator of the game. No other company collects data through the game.
2. Data that stays on the device (never sent to us)#
- The island save, inventory, story progress, avatar choices, language and sound settings.
- Parent settings (play-time limit, the date and version of the online-mode consent, the "Gameplay stats" switch), daily play-time counters, parent-gate attempts.
- The raw gameplay-stats counters (total play time, number of sessions and days, the last local day played, blocks broken and items crafted). Nothing is sent while offline; in online mode only the small summary in Section 3 goes.
- The on-device friend list (up to 20 entries: preset nickname, last seen, blocked flag) and the host's 24-hour "visit journal" (the guest's nickname and the blocks they changed).
- Photo mode: photos are renders of the game's own island and avatar; the real camera is never used. They are kept in the game's album (up to 60). A child can "Save to Photos" (the device gallery) and, on iOS, open the system share sheet (the share sheet is off on Android). Where a shared photo goes is handled by the device; the game never uploads a photo.
- Read-aloud uses the device's own text-to-speech; no audio is recorded.
- Kubi Club (subscription): purchase, renewal, cancellation and refunds are handled by the Apple App Store / Google Play under their own terms and privacy policies. The game never sees card details, names, email or billing data. The device keeps only "membership on or off, plan (monthly / yearly), the expiry date reported by the store"; this is not part of the cloud backup and is never sent to our server. Purchases are verified on the device with the store's signed transaction record. Manage or cancel it on iOS in Settings > Apple ID > Subscriptions, on Android in Google Play > Payments & subscriptions.
- Hearts and local notifications (owner decision 2026-10-17): the character's hearts and the "last played" time are kept in the save on the device. Notifications are set up only in the device's own notification system (iOS: UNUserNotificationCenter, Android: WorkManager); no server, no push, no device token and no advertising id are used and no data leaves the device. Permission is asked with the operating system's own prompt after a parent-facing explanation (optionally behind the parent gate), never at the first launch. It can be turned off on the Parent panel > "Hearts and notifications" page (on by default). At most 3 a day, quiet from 20:30 to 08:00; the texts are game status only, never ads or purchases.
On Android, game data is excluded from Google backup. On iOS, game data (including the random device id used by online mode) may be included in the device's iCloud or computer (Finder/iTunes) backup. That backup is in your Apple account and never reaches us. If the phone is restored from it, the game may reach its old cloud backup again.
"Delete all data" (Parent panel) erases all game data on the device, including the photos in the game's album. Photos already saved to the device gallery must be deleted from the gallery itself.
3. Data processed on our server when online mode is on#
Online mode is turned on only when a parent passes the parent gate and accepts the consent page. From then on, our server (a Nakama game server hosted by Hetzner Online GmbH in Germany) processes:
| Data | Why | How long |
|---|---|---|
| Random device id (a UUID the game creates at the first online sign-in; not the phone's hardware or advertising id) | Anonymous sign-in; knowing the backup belongs to this install | Until deleted, or after 12 months without play |
| Server account id, a random server-generated username, account created/updated times | Running the account | Same |
| Nickname (a preset adjective + animal, e.g. "Happy Hedgehog") | Shown to the other child during a visit | Same |
| Island backup (game progress, inventory, avatar choices, the chosen preset nickname, the child's language/sound/difficulty settings; if a picture-frame item shows an album photo, only that photo's in-game id, never the image; parent settings, play time, friend list, visit journal and photos are not included; max 512 KB) | Cloud backup and restore; automatic every 5 minutes and on exit | Same |
| Linked account: Apple / Google user number (only if the parent taps "Link with Apple / Google" on the "Account" page; the stable user number Apple / Google gives this app. E-mail, name and profile picture are not requested; the e-mail / name / picture Google puts in its sign-in token are deleted on the server at once) | Restoring the island backup on a new phone ("Sign in to my account") | Until unlinked, the account is deleted, or 12 months without play |
| Gameplay stats (optional, off until the parent separately turns them on; pseudonymous: kept under the game's random account, no name, e-mail, nickname, pet name, text, location, exact time or device id; numbers kept under the game's random account: total play time, number of sessions and days played, the current island and stage, islands unlocked / finished, blocks broken and items crafted plus the 10 most crafted items, number of animals, the pet's species, village size, Club member yes/no, difficulty, app version, platform; the server only adds the day of the last update). It travels with the existing backup; there is no separate tracking stream | Improving the game: only aggregate results are looked at (e.g. average daily play time, which island players get stuck on). Never used for ads, tracking, profiling or contacting anyone | With the account (deletion request or 12 months without play); deleted at once when the parent turns off Parent panel > My server data > "Gameplay stats" (if the server cannot be reached, the next time the game connects) |
| Transfer code (a single-use code of 8 coloured shapes; holds no personal data) and the account's "backup owner" counter | Moving the backup to a new phone (iPhone ↔ Android) | 24 hours; void once used; deleted with the account |
| Invite record (6-letter code, join requests, the account ids and one-invite handles of approved guests) | A visit the host approved | 24 hours (a pending request 15 minutes) |
| Blocked players (the blocked account's id and time) | Child safety | Until the blocking or the blocked account is deleted |
| Recent requesters (one-invite handle → account id) | Letting the host block someone who already left | 24 hours |
| Technical records: request counters (last hour), last active day | Limiting abuse; the 12-month deletion clock | With the account |
| Salted hash of the IP address (SHA-256 with a secret salt) and times. The IP address itself is never written to the database. The hash is pseudonymous: whoever holds the salt could match it back to an IP, so we treat it as personal information | Per-IP limits on account creation and join attempts | About 1 day after the last request from that IP |
| Throwaway visit account (a random account per visit) | Hiding the real account id from the other player | Until the visit ends (at most 1 day) |
| Server error logs (level ERROR; designed to contain no ids, may rarely contain an account id). No access logs (IP addresses) are kept | Operating and securing the service | At most 7 days |
| Database backups | Disaster recovery | 7 days; deleted accounts leave the backups after this period |
During a visit (co-op) the other child receives, through the server and only for the visit: the nickname, avatar look codes, in-game position, preset phrases/emojis and (for a host) the island's block layout. None of this is stored on the server; a visit lasts at most 2 hours. The other family's device may keep your child's preset nickname in its own on-device friend list and (for a host) in its 24-hour visit journal; that stays on their device, not with us. Account ids, settings, play time, inventory and photos are never sent to the other child. A child can only enter another island if the host shares the code and approves the request.
Children cannot make personal information public: there are no free-text fields, chat, profile pages or public lists.
What we do not collect: name, email, phone, address, date of birth, location, photos/voice/video, contacts, advertising id, hardware id, third-party usage analytics, crash reports.
4. Why, and on what legal basis#
- Gameplay stats (improving the game): the parent's separate consent: its own row and its own switch (off by default) on the online-mode consent page, and its own switch on My server data; saying no does not affect the backup or anything else — GDPR Art. 6(1)(a), KVKK Art. 5/1. Results are only looked at in aggregate.
- Cloud backup, invites and visits: providing the service the parent turned on — GDPR Art. 6(1)(b), KVKK Art. 5/2-(c). For children, parental consent is also obtained (COPPA §312.5, GDPR Art. 8).
- Security and abuse prevention (IP hash, counters, blocks, logs): legitimate interests — GDPR Art. 6(1)(f), KVKK Art. 5/2-(f).
- Legal obligations (e.g. lawful requests by authorities): GDPR Art. 6(1)(c), KVKK Art. 5/2-(ç).
COPPA internal-operations notice (§312.4(d)(3)) —: The device id, account id and IP hash are used only for these internal operations: authenticating the user, saving the child's own game progress and choices (personalization), carrying network communications between two devices, protecting the security and integrity of the service, and meeting legal requirements. We prevent their use to contact a specific person, for behavioral advertising or for profiling by these means: the game has no ads, third-party analytics or SDKs; gameplay stats are only looked at in aggregate to improve the game and are never shared; server telemetry is off; the IP is kept only as a salted hash for about 1 day; children cannot enter free text; the server accepts only allow-listed preset ids; and no data is shared with anyone.
We do not use data for automated decision-making or profiling. If we change the purposes we will inform you first and ask for consent again (the in-app consent page is shown again with a new version).
5. Who receives data#
Data is not sold and not shared with third parties. The only exception is the service itself: in a visit approved by the host, the preset data listed in §3 (nickname, avatar look, in-game position, preset phrases, island layout) is relayed to the other player in that visit only. Apart from that, only this service provider processes data on our behalf and on our instructions:
| Recipient | Role | Country | Safeguard |
|---|---|---|---|
| Hetzner Online GmbH | Server and database hosting (processor) | Germany (EU) | Written data processing agreement (GDPR Art. 28) |
| Cloudflare, Inc. | Securing and carrying connections to the server (DDoS protection, encrypted connections); processes the IP address in transit and does not store it (processor) | USA (global network) | Data processing agreement and EU Standard Contractual Clauses |
The provider may not use the data for any other purpose and has committed to protect it at least as well as we do. Information may be disclosed to authorities where the law requires.
6. Security#
The connection to the server is encrypted only (HTTPS/WSS, TLS). The admin console is not exposed to the internet. Logs are configured not to record ids. In the database the IP address is kept only as a hash with a secret salt. Access restrictions, rate limits and allow-lists are applied. We keep a written information security program and review it at least yearly. In a data breach we notify the Turkish Personal Data Protection Board within 72 hours and you where required.
7. Retention and deletion (written retention policy)#
We keep data only as long as needed for the purpose above; nothing is kept indefinitely:
- Account, nickname, island backup, counters, blocks: until you delete them, and automatically deleted by a daily job after 12 months without play.
- A linked Apple / Google user number: deleted at once with "Unlink", with the account ("Delete account"), or after 12 months without play. Transfer codes are valid for 24 hours and are deleted with the account.
- Invite records, recent requesters: 24 hours. IP hashes and throwaway visit accounts: about 1 day.
- Server logs: at most 7 days. Database backups: 7 days.
- Deleted data is not kept in retrievable form; a copy left in a backup expires with the backup and may be used only for disaster recovery in that time.
- Id-free deletion records (date and count) are kept for 3 years as Turkish law requires.
8. Your rights as a parent and how to use them#
Inside the app (fastest): Parent panel → parent gate →
- Turn online mode off: stops any further collection at once (withdraws consent). It does not delete what is already on the server; use the button below for that (otherwise it is deleted automatically after 12 months).
- "Delete server data" (Cloud backup page) or "Delete all data" (Parent panel): the server account and all the data above are deleted at once. Without internet the request is kept and retried at every launch; nothing else is sent meanwhile. The app shows when deletion is complete. Works even with online mode off.
- "My server data" (Parent panel → Privacy): see what the server holds, right inside the app (account date, backup date and size, nickname, number of blocked players, linked account, last active day, consent version and date).
To review or delete server data, or for any other request, by email: destek@kubioneblock.com. Accounts hold no name or email, so without the app (e.g. a lost device) we may not be able to find the account; it is then deleted automatically after 12 months of no use. We may ask for reasonable information to confirm that you are the child's parent. We answer within 30 days, free of charge.
- United States (COPPA): you can review the personal information collected from your child, have it deleted, and refuse further collection. If you refuse, online features turn off; single-player always works.
- Turkey (KVKK): your rights under Article 11 of Law 6698. If a request is refused or not answered within 30 days you may complain to the Personal Data Protection Board.
- EU/UK (GDPR): access, rectification, erasure, restriction, portability, objection and withdrawal of consent; and the right to complain to your local data protection authority.
Account and data deletion (for Google Play / App Store)#
If an account was linked: Parent panel → Account → Delete account deletes the account, the link, any transfer code and all server data at once (the same as "Delete server data" on the Cloud backup page). Every phone attached to the account leaves it; the island stays on those phones. To delete the Kubi: One Block Island (Fatih Durmaz) account and its data: Parent panel → Cloud backup → Delete server data. If the app is no longer installed, email destek@kubioneblock.com; accounts hold no name or email, so we may not be able to find it, and an unused account is deleted automatically after 12 months. Deletion is immediate; it leaves backups within 7 days. No data is retained (only an id-free deletion count).
9. Changes#
If we change this policy we publish the new version at this address. If the data collected or the purposes change (e.g. a new kind of data), the app shows the consent page again with a new version; without consent, online mode stays off.
10. Contact#
Fatih Durmaz · destek@kubioneblock.com · https://kubioneblock.com