Privacy policy
What we collect when you play Koven, why we collect it, and what you can tell us to do with it.
Last updated
The short version
We collect as little as we can get away with. A guest joining a room gives us a nickname and an avatar, and that is it. An account holder gives us an email address so they can sign back in.
We do not run advertising, we do not build advertising profiles, and we never sell or rent your personal data to anybody.
Your data is stored in the United Kingdom. You can ask us for a copy of it, ask us to correct it, or ask us to delete it, and we will do that free of charge.
If you are under 18 there are extra protections that are on by default and that we will not ask you to turn off. If you are a parent, the section on children tells you exactly what you can control.
This summary is here so that the rest is easier to follow. The sections below are the part that counts.
1Who we are
In plain EnglishKoven is run by a company in the United Kingdom. This is how you reach us.
Koven is operated by [REGISTERED COMPANY NAME] ("we", "us"), a company registered in England and Wales with company number [COMPANY NUMBER], registered office [REGISTERED OFFICE ADDRESS].
We are the data controller for the personal data described in this policy. We are registered with the Information Commissioner's Office under registration number [ICO REGISTRATION NUMBER].
You can reach us about anything in this policy at support@kovengames.com, or by post at the registered office above. Put "privacy" in the subject line and it will get to the right person faster.
2What we collect
In plain EnglishA nickname if you are a guest. An email address if you make an account. What happened in the games you played. Anything you write or draw and choose to save.
We group what we collect by the reason you gave it to us, because that is the honest way to read a list like this.
- Joining a room as a guest
- The display name you type and the avatar you pick, plus a temporary identifier for your device so the game knows which answers are yours. No email address, no account, no sign in.
- Making an account
- An email address, a display name and an avatar. If you sign in with Apple or Google we receive the identifier they give us and, unless you hide it, an email address. We never receive your password.
- Playing
- Which rooms you were in, which format was played, the answers and drawings you submitted during a round, scores, and the times things happened. Round content is kept only as long as the room needs it, as set out under how long we keep things.
- Making and sharing content
- Decks you create, the items inside them, the title and description you give them, whether you published them, and any ratings or remixes that follow.
- Safety and moderation
- Reports you make about somebody else, reports other people make about you, the decisions a moderator took and why, and the blocks you have set. We keep these even after the content itself is gone, because that is the record that stops a repeat offender.
- Paying
- Whether you have an active subscription and what it entitles you to. Apple, Google and our subscription provider handle the payment itself. We never see your card details.
- Technical data
- Your IP address, the type of device and browser you used, and error diagnostics when something breaks. IP addresses are used for security and rate limiting and are not used to work out where you live beyond the country.
- Getting in touch
- Whatever you write to us and the address you wrote from.
- Waitlist
- Your email address, whether you confirmed it, and when. Nothing else.
We do not ask for your location, your contacts, your calendar, your photos or your microphone. Koven has no reason to want them.
3Why we use it, and our lawful basis
In plain EnglishMostly to run the game you asked us to run. Some of it to keep the app safe. A little of it only if you say yes.
UK data protection law makes us give a reason, in law, for every use of your data. Ours are these.
| What we do with it | Our lawful basis |
|---|---|
| Run rooms, keep score, show you the game and let you sign back in | Performance of our contract with you, which is the terms of service |
| Store the decks you make and show them to the people you shared them with | Performance of our contract with you |
| Moderate content, act on reports, block abuse and enforce the community guidelines | Legitimate interests: keeping a family product safe for the families in it, and protecting other players |
| Rate limit, detect fraud and keep the service standing up | Legitimate interests: security and availability |
| Understand which parts of the app are used, using aggregated counts | Legitimate interests: making the product better without tracking individuals |
| Send you a confirmation email and then waitlist updates | Consent, given twice: once when you type your address and once when you click the link we send |
| Keep records of moderation decisions, payments and legal notices | Legal obligation, and legitimate interests in defending claims |
Where we rely on legitimate interests we have weighed our interest against yours and written down the result. Ask us for that assessment and we will send it to you.
Where we rely on consent, you can take it back at any time. Doing so does not undo anything we did while the consent was live.
4Children, and what parents can do
In plain EnglishIf you are under 18, the strongest settings are already on and we will not ask you to turn them off. If you are under 13, a parent has to say yes before you can have an account.
Koven is built to be handed to a ten year old. That shapes the whole product, and this section is the part of the policy we would most like you to read.
- Every new account starts on the most protective settings we offer. Community content is off, your profile is not discoverable by strangers, and anything you publish stays private until you deliberately change that.
- We never nudge a child towards a weaker setting. There is no reward for making your profile public, and no screen that treats the safe option as the boring one.
- We do not profile children. We do not use anything a child does to build a behavioural profile, to target advertising, or to decide what to push at them next.
- We do not use tricks that keep you playing. No streak that punishes you for stopping, no timer running while the app is closed, no notification designed to pull a child back at bedtime.
- Guests do not need an account at all. A child can join a family game with a made up name and give us nothing else.
- We ask for a year of birth when you make an account, so that we can apply the right protections. We do not publish it and we do not use it for anything else.
If you are under 13 and in the United Kingdom or the European Economic Area, you need a parent or carer to agree before you can have a Koven account. If you are under 13 and in the United States, the Children’s Online Privacy Protection Act applies and we ask for verifiable parental consent before an account holds any personal information. Until that consent is given, the account cannot publish content, cannot be searched for and holds no email address of its own.
A parent or carer can ask us what personal information a child’s account holds, ask us to correct it, ask us to delete it, or withdraw consent so that we stop collecting anything further. Email support@kovengames.com from the address on the account or tell us enough for us to be confident who you are. We do not charge for this and we will not make you argue for it.
If we find out that a child under 13 has made an account without a parent agreeing, we delete it and everything in it.
6Where your data lives
In plain EnglishIn the United Kingdom. If any of it has to leave, it stays legally protected.
Our database and file storage sit in the London region, so the ordinary answer is that your data does not leave the United Kingdom.
Some of the companies above operate globally, so a support engineer somewhere else may need access, and email delivery may pass through servers abroad. Where that happens we rely on UK adequacy regulations, or on the International Data Transfer Addendum to the standard contractual clauses, and we check that the transfer still protects you before we make it.
7How long we keep it
In plain EnglishOnly as long as it is useful, and less than you would expect for the things that matter least.
| What | How long |
|---|---|
| A guest session, including the nickname you typed | Deleted 24 hours after the room closes |
| Room and round content, including answers and drawings | 30 days after the room closes, then deleted |
| Your account and the decks you made | Until you delete the account |
| A deck you delete | Removed from view straight away, and purged within 30 days unless it is part of an open moderation case |
| Moderation reports and decisions | 2 years, so that a pattern of behaviour is visible even after the content has gone |
| Waitlist entries | Until you unsubscribe, or 24 months after we last heard from you |
| Unconfirmed waitlist entries | 7 days, then deleted |
| Support conversations | 2 years |
| Payment and tax records | 6 years, because UK tax law says so |
| Security and rate limiting logs | 90 days |
When you delete your account we remove your profile, your email address and your decks. Content you published to the community and that other people have since remixed is anonymised rather than removed, because deleting it would take away work that is now somebody else’s.
8Your rights
In plain EnglishYou can ask for a copy of your data, ask us to fix it, ask us to delete it, or tell us to stop. Email us and we will do it within a month.
Under UK data protection law you have the following rights, and exercising them is free.
- Access
- Ask what we hold about you and get a copy of it.
- Rectification
- Ask us to correct anything wrong or fill in anything missing.
- Erasure
- Ask us to delete what we hold. Most of the time we simply will. Where we have to keep something, for example a tax record or a moderation decision, we will tell you exactly what and why.
- Restriction
- Ask us to keep your data but stop using it, while something is being sorted out.
- Portability
- Ask for the data you gave us in a machine readable file that you can take elsewhere.
- Objection
- Object to any use we base on legitimate interests, including a use we have not thought of yet.
- Withdrawing consent
- Change your mind about anything you agreed to, at any time.
Email support@kovengames.com and we will answer within one month. If your request is unusually complicated we may need two more months, and if we do we will tell you inside the first month and say why.
If you are not happy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first so we can put it right, but you do not have to.
9Cookies and similar technologies
In plain EnglishOnly the ones that make the site work. No advertising cookies, so no consent banner nagging you.
We use a small number of strictly necessary cookies and equivalent browser storage. They keep you signed in, remember which room you are in, and hold your theme preference. UK law lets us set these without asking, because without them the thing you asked for would not work.
We do not use advertising cookies, tracking pixels or cross site trackers, and we do not embed third party widgets that set their own. That is why there is no cookie banner in your way.
Our product analytics count events, not people. They do not set an identifier that follows you around the internet.
10How we look after it
In plain EnglishEncrypted in transit and at rest, with access limited to the people who need it.
- Everything travels over encrypted connections and is encrypted at rest.
- Row level security is switched on for every table that holds your data, so the database itself enforces who may read what rather than trusting the app to remember.
- Access to production data is limited to the people who need it to do their job, and is logged.
- Moderation actions are recorded in an audit log that moderators cannot edit.
- We test the negative cases: our test suite proves that a person who should not be able to see a row genuinely cannot.
If a breach ever puts you at risk we will tell the Information Commissioner within 72 hours and tell you without undue delay. If you think you have found a security problem, email support@kovengames.com with "security" in the subject and we will come back to you.
11Automated decisions
In plain EnglishA filter can hide something automatically. A person decides whether it stays hidden, and you can appeal.
We use automated checks to catch obviously harmful content before anybody sees it, and to spot spam and abuse. That is the only automated processing we do that affects you.
No account is suspended, and no content is permanently removed, on an automated decision alone. A person reviews it, you are told what happened, and you can ask for it to be looked at again. We do not make decisions with legal effects about you by automated means, and we do not profile you.
12Changes to this policy
In plain EnglishIf we change something that matters, we will tell you before it takes effect.
We update this policy when the product changes. Small corrections go up with a new date at the top. Anything that materially affects your rights or widens what we do with your data will be flagged to you in the app or by email at least 14 days before it takes effect, and where the law needs your consent we will ask for it rather than assume it.