Privacy policy
This policy explains what KnowBall collects, why, the legal basis for doing so, who else touches it, and how to exercise your rights. It covers both the KnowBall mobile app and the pre-launch waitlist at knowball.us.
Who we are
KnowBall is operated by CXC Studio LLC ("KnowBall," "we," "us"). For anything in this policy, reach us at support@knowball.us. For people in the EU and UK, we act as the data controller for the information described below.
What the app collects
Your account
- Email address, if you sign in with an email code, or if Apple or Google shares one with us. Apple Private Relay addresses work fine; we never see your real address in that case.
- A sign-in identifier from Apple or Google, if you use those buttons. It identifies your account to us and nothing else.
- Your handle, which is public — it appears on leaderboards, on friends' screens, and on anything you share.
- Favorite team and equipped cosmetics (banner, frame, avatar, title), which are also public.
You can play as a guest without giving us an email at all. A guest account is tied to your device, and we tell you plainly that it can't be recovered if you lose the device.
How you play
- Game results: puzzles solved, guesses used, scores, run lengths, solve times, streaks.
- Per-question records: which question you saw, whether you got it right, and how long you took. We use these to balance difficulty, retire bad questions, and detect cheating.
- Progression and economy: XP, account level, Ball Coins earned and spent, items owned, badges, season and prestige standing.
- Leaderboard entries, which are public by design.
- Social activity: friends and friend requests, invite and challenge codes, party sessions you join.
Purchases
If you buy Ball+ or Ball Coins, Apple or Google processes the payment. We never see or store your card details. We receive a record that a purchase happened, what it was for, and whether a subscription is active, through our purchase provider (RevenueCat), so we can unlock what you paid for and restore it on a new device.
Ads
KnowBall shows optional rewarded video ads — you choose to watch one in exchange for an extra run or a streak save. There are no forced ads, no banners, and never any ads during the Daily. Ads are served by Google AdMob. When you finish one, Google tells our server directly that it completed, so the reward can't be faked; that check is between Google and us.
On iOS we ask, using Apple's standard prompt, whether you'll allow tracking. If you say no — or never answer — we request non-personalized ads only and your device's advertising identifier is not used for ad targeting. If you say yes, AdMob may use that identifier to personalize what you see. You can change your answer at any time in iOS Settings → Privacy & Security → Tracking. On Android you can reset or delete your advertising ID in Google settings.
Technical and diagnostic data
- An app-generated device identifier, plus platform, app version and build number, sent with requests. We use these to spot abuse of the coin economy and to debug problems. It is specific to KnowBall and is not the kind of identifier that can follow you across other companies' apps.
- Your IP address, which appears in server request logs and is used for rate-limiting and abuse prevention.
- Server-side error reports, through Sentry, when a request of yours fails. These include your account ID and the app version, platform and device identifier above, so we can reproduce the problem. The app itself carries no crash-reporting SDK.
- A push notification token, only if you turn notifications on.
We do not use any third-party behavioral analytics SDK in the app. We do not collect your contacts, photos, precise location, health data, or browsing history from other apps.
What the waitlist collects
The pre-launch signup at knowball.us stores only what it needs: your email address, your username, an optional display name, an invite code generated for you, the referral relationship if you arrived through someone's link, your signup date and a source tag, and your Google account identifier, name and email if you chose "Continue with Google".
Verification codes — for the waitlist and for email sign-in in the app — are stored only as a SHA-256 hash, never the code itself, are single-use, and expire. Your IP address is used transiently for rate-limiting and the anti-abuse challenge.
Why we collect it, and our legal basis
Under the GDPR, each purpose has a legal basis:
- Run your account and the game: save progress, sync across devices, compute levels and rewards, deliver what you bought. Basis: performance of a contract — our terms of service.
- Leaderboards, friends, and sharing: show your handle and results where the feature calls for it. Basis: contract, plus your action in adding a friend or sharing a result.
- Balance and improve the game: use per-question results to tune difficulty and retire bad content. Basis: legitimate interest in making the product work.
- Security and anti-cheat: rate-limiting, bot challenges, and detecting economy abuse. Basis: legitimate interest in protecting the service and honest players.
- Personalized ads: only where you've opted in. Basis: consent, withdrawable at any time in your device settings.
- Non-personalized ads: the default. Basis: legitimate interest in funding a game that is free to play.
- Waitlist and launch email: confirm your spot and email you once at launch. Basis: consent, withdrawable at any time.
Continue with Apple or Google
If you sign in with Apple, we receive an account identifier and, if you allow it, an email address (possibly a private relay one). If you sign in with Google, we receive your basic profile — email and name — and a unique account identifier. We use these only to create and verify your account and to contact you about it. KnowBall's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Apple or Google sign-in data for advertising.
Cookies and analytics
The app sets no cookies and carries no analytics SDK. On the website, we use Cloudflare Turnstile to block automated signups, which may set short-lived, strictly-necessary cookies while a challenge runs, and Plausible Analytics, which is privacy-friendly, cookieless, EU-hosted, and collects no personal data. Because the only cookies are strictly necessary for security, no cookie-consent banner is required, but we describe them here for transparency.
Who we share it with
We do not share your information with anyone for their own purposes. We use a small set of service providers ("processors") that handle data only on our instructions:
- Supabase and Render — database and hosting.
- Sentry — server-side error reporting.
- RevenueCat — purchase and subscription records.
- Apple and Google — sign-in and payment processing.
- Google AdMob — rewarded ads (see below).
- Our email delivery provider — sign-in codes and the launch notice.
- Cloudflare and Plausible — website anti-abuse and analytics only.
Where a leaderboard, friend list, or shared result is involved, your handle, cosmetics and score are visible to other players. That's the point of those features, and nothing else about you is exposed there.
We do not sell your personal information
We do not sell your personal information, and we never have. Under the California Consumer Privacy Act (CCPA/CPRA), allowing an advertising identifier to be used for personalized ads can count as "sharing" for cross-context behavioral advertising. That only happens if you affirmatively opt in through Apple's tracking prompt, and you can withdraw it at any time in iOS Settings → Privacy & Security → Tracking, or by resetting your advertising ID on Android. If you never opt in, no such sharing occurs. Recording a referral you opted into is not a sale.
Where your data is processed
KnowBall is operated from the United States, so if you use the app or sign up from outside the US your information will be processed in the US. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for international transfers. Plausible processes website analytics in the EU.
How long we keep it
- Your account and game history: until you delete your account.
- Server request logs (including IP addresses): about 30 days, then discarded.
- Verification codes: deleted the moment they're used, and expire on their own regardless.
- Purchase records: kept as long as needed for support, refunds, and tax and accounting obligations.
- Waitlist records: until launch and a reasonable period afterward to honor Founder status and rewards, or until you ask us to delete them.
Deleting your account
You can delete your account from inside the app: Settings → Delete account. That removes your profile, progress, stats, friendships, and cosmetics from our database. Purchase records we're required to retain, and aggregate counts that no longer identify you, may remain. You can also email support@knowball.us and we'll do it for you.
Your choices
- Ads: opt out of personalized ads in your device settings at any time. Rewarded ads themselves are always optional — you never have to watch one to play the Daily, and a Ball+ subscription removes them.
- Notifications: turn push on or off in the app, or in your device settings.
- Email: sign-in codes are only sent when you request one. Any launch or announcement email has an unsubscribe link.
- Playing as a guest: you can use most of KnowBall without giving us an email address at all.
Your rights
Depending on where you live, you have the right to access, correct, delete, or receive a copy of your data; to object to or restrict certain processing; to withdraw consent; and to opt out of any sale or sharing. Exercising these rights will never result in discriminatory treatment — your account, progress and purchases are unaffected. Email support@knowball.us and we'll respond within 30 days. EU and UK residents may also complain to their local data-protection authority.
Security
Traffic between the app and our servers is encrypted in transit. Sign-in codes are stored hashed and are single-use. Access to production data is limited to the people who need it. No system is perfect, and we won't pretend otherwise — but if a breach ever affects your data, we'll tell you and the relevant authorities as the law requires.
Children
KnowBall is not directed to children under 13 (or under 16 in the EU and UK), and we do not knowingly collect their information. If you believe a child has an account, email support@knowball.us and we'll remove it.
Changes
We'll update this policy as the product grows, and the "last updated" date above reflects the most recent change. If a change materially affects how we use your information, we'll tell you in the app before it takes effect.