KarKarciak website statistics (Umami)
Karciak uses Umami, served from https://idtv.pl/script.js, to measure visits and page navigation. The tracker sends page URLs and titles, referring page, browser language, screen dimensions and basic device information to https://idtv.pl. Umami does not use tracking cookies.
We have not configured Umami user identification or custom events containing account details, email addresses, nicknames, chat messages or game moves. The separate Google Analytics and advertising descriptions below do not mean those services are enabled on Karciak.
1. Data controller
The owner of the Karciak service is the controller of personal data processed by the Service. Contact kontakt@idtv.pl for all personal-data enquiries. This is also the contact retained for the Karciak English edition.
2. Data we collect and why
We do not collect a telephone number. An email address is obtained only through Google sign-in and is not used for marketing. We do not make automated decisions about users that produce legal effects. Website advertising is described in section 3a and Android advertising in section 3b.
| Data | Purpose | GDPR legal basis |
|---|---|---|
| Nickname, friend code and player identifier | Games, friends and ratings | Article 6(1)(b): providing the service |
| Username and password; the password is held only as a salted scrypt hash | Sign-in across devices | Article 6(1)(b) |
| Email address and Google account identifier, only if you choose Google sign-in | Account creation, authentication and access protection | Article 6(1)(b) |
| Match results, ELO, XP and achievements | Ratings, statistics and game history | Article 6(1)(b) |
| Chat messages with nickname and time | Moderation of abuse and spam | Article 6(1)(f): legitimate interests in player safety |
| IP address | Abuse protection, including sign-in attempt limits and IP bans | Article 6(1)(f) |
3. Cookies and browser storage
The Service uses storage needed for its operation and, where available and consented to, Google Analytics and Google advertising cookies. Essential game and account data does not depend on optional analytics consent.
The existing Karciak website uses Google Analytics 4, measurement ID G-XGDK2JMJ1Q, to measure visits, pages used and basic technical device information. The provider is Google Ireland Limited. Analytics is not loaded before consent. Rejecting it does not remove access to games; the choice is stored as karciak_analytics_consent. Its stated legal basis is Article 6(1)(a), consent. Where analytics is available, its consent settings allow you to change that choice.
- karciak_session: a cookie lasting up to 30 days, used to keep you signed in.
- localStorage, including ld_identity, ld_muted and ld_seen_rules: guest identity, sound preferences and other settings kept in your browser.
3a. Advertising on the Karciak website
Karciak.pl displays Google AdSense advertising provided by Google Ireland Limited. Third-party suppliers, including Google, use cookies and similar technologies to display ads based on previous visits to that and other websites. These cookies support personalisation, ad measurement and abuse prevention.
Visitors in the European Economic Area, United Kingdom and Switzerland are asked for choices through Google’s certified consent-management form. The existing policy describes non-personalised ads when personalisation is not consented to; those ads may still use cookies for limited measurement and abuse protection. Consent-based processing is described under Article 6(1)(a), and consent may be withdrawn.
Google Ad Settings and the external advertising-choice services linked below provide further controls. Google’s partner-site information explains how its data use works. Advertising is not a condition for access to the games. Karciak does not currently load website ads.
3b. Advertising in the Karciak Android app
The existing Android app uses Google AdMob for full-screen advertising after a game. Google’s advertising SDK may collect and send an IP address, approximate location derived from it, device identifiers, app and ad interactions, and diagnostic information. These support ad delivery, measurement, analysis and abuse prevention.
Required privacy choices are collected through Google User Messaging Platform. Ad requests start only when the consent form and saved choices permit them. Personalisation depends on those choices and Google settings. Where Google requires ongoing consent controls, the app provides Settings → Ad privacy → Manage consent. Lack of consent does not block games. Android settings also provide controls for the advertising identifier.
Google’s privacy and partner-app information explain its processing and retention. The app also stores the last 100 finished-game identifiers to avoid showing a repeated ad after returning to the same result; older entries are replaced.
3c. Firebase and Android reminders
With optional consent, Google Analytics for Firebase measures app use, ad impressions and advertising revenue, including figures such as average revenue per user. The provider is Google Ireland Limited. Measurement is off by default and can be changed in app settings. Our analytics events do not include nickname, email, chat content or game moves. Google’s SDK also processes an app-instance identifier and basic device and session information. Firebase and AdMob analytics and advertising data are linked.
Since app version 0.1.32, Firebase Crashlytics reporting has a separate optional choice, independent of app statistics, including for native 3D-engine crashes. Reports contain stack traces, app state, basic device data and random installation identifiers. Added labels identify technical screens, games and action types, not account identifiers, nicknames, emails, chat or move contents. Reporting is off by default. It can be enabled through an optional home-screen card or Settings; dismissing or skipping the card does not block play, and an earlier statistics choice does not enable crash reporting.
Disabling crash reporting stops extra logs and records the automatic-upload choice for later launches. The existing policy describes Crashlytics reports and related identifiers being retained for 90 days before deletion starts; raw native minidumps are held temporarily during processing. Firebase’s privacy information is linked below.
Firebase Cloud Messaging delivers game-event and reward reminders. Notifications are enabled when Android settings permit them; Android 13 and later require system permission. A player’s earlier opt-out is preserved. The server stores a notification token, random installation identifier and account association. At 20:00 Europe/Warsaw it checks whether the free wheel spin remains available; the wheel resets at midnight.
Reminders can be disabled in app or Android settings. Tokens are removed when the feature is disabled, on sign-out, when invalid or after 90 days without an update. Notifications do not contain chat content or account data.
4. Retention
- Account data and statistics: until the account is deleted by you or the administrator.
- Chat: approximately the latest 5,000 messages across the Service; older messages are removed automatically.
- IP addresses: in server memory during the connection; for a ban, until it expires or is lifted.
- Database backups: up to the latest 30 copies. Data deleted from the live Service disappears from backups as they rotate.
5. Data recipients
We do not sell personal data. Data needed to run the Service is held with its hosting provider, acting as a processor. If you choose Google sign-in, Google supplies the basic account information needed for authentication.
With consent, analytics data is sent to Google Ireland Limited under the applicable Google Analytics arrangements. When advertising is displayed, Google Ireland Limited and its advertising partners process the data described in section 3a. Data may also be supplied to authorised public authorities when required by law.
6. Your rights and account deletion
You have rights of access, rectification, erasure, restriction and portability, and may object to processing based on legitimate interests. You may also complain to the President of Poland’s Personal Data Protection Office, UODO.
Use Delete account in your profile to permanently remove the account, statistics, friends and sessions from the live Service immediately. Backup rotation is explained in section 4. For other data requests, contact kontakt@idtv.pl.
7. Security
Connections use HTTPS encryption. Passwords are stored as salted scrypt hashes and session tokens as hashes. Administrative tools have protected access.
8. Policy updates
The current Polish policy is available at karciak.pl/prywatnosc with its effective date. This English edition is available in the Karciak privacy section. Significant changes are announced within the Service.