Privacy policy
Last updated ·
01Who runs the game?
PAWPAW POP is operated by Kihya Co., Ltd. Contact help@kihya.com for privacy, access, correction or export requests. This notice applies to the current web service. This also applies to the iOS and Android apps, which provide the web game over an internet connection.
02What do we store?
Sign-in, public profiles, external sharing, optional analytics and external ads described below are available only to users who select age 18 or over. Google and Apple sign-in use Firebase Authentication, which processes provider identifiers, email and authentication details. The game stores separate identifiers, nickname, picture, optional country and Instagram, and game records. We do not offer our own password or email-code sign-in.
03How is it used?
Data supports account verification, cross-device progress, gameplay, rewards, duplicate prevention and security. Request limits use hashes derived from IP or similar information. Support processes your email and message to respond.
04What stays on my device?
Sign-in cookies last up to 14 days; guest cookies up to one year. Your device also stores preferences, an unfinished puzzle, pending records and analytics consent. Blocking essential storage may prevent sign-in or progress recovery. Apps store an age band (under 13, 13–17, 18+, or not selected), ad privacy choices and pending reward requests. We do not request a date of birth. The web stores an age-band cookie for up to one year to enforce server-side feature restrictions. No date of birth is requested.
05Hosting, external services and ads
Sign-in, public profiles, external sharing, optional analytics and external ads described below are available only to users who select age 18 or over. Our server stores game records; Google Firebase and Google or Apple handle authentication. Web and app rewards can use our own channel-promotion ads. External ads are enabled by service settings after approval. House ads do not call third-party ad SDKs. Enabled external app reward ads use Google AdMob and Google UMP for privacy choices. Ad delivery and fraud prevention may process IP addresses, app and device information, ad interactions and reward verification records. We request non-personalized ads and do not request access to IDFA or the Android advertising ID. Providers may process data abroad. There are no payments.
06Sharing is your choice
Sign-in, public profiles, external sharing, optional analytics and external ads described below are available only to users who select age 18 or over. After moderator approval, your nickname, picture, chosen country and Instagram are visible to people with the link. Email and authentication identifiers are not public. Profiles may appear on future leaderboards. Cards and invitations are shared only when you choose.
07Retention and deletion
Account and game records are retained while providing the service. Deletion disables sign-in and public profiles, removes server and Firebase account data, and submits a GA4 user-deletion request. Temporary failures retry automatically. Provider processing, rotating backups and files on other devices may remain for a time. Guest game records are automatically deleted 365 days after the last visit. A deleted guest’s identifier hash is retained for up to 30 days to prevent in-flight requests or revisits from restoring deleted records. Server game-operation events are retained for up to 90 days. These records are then automatically removed.
08Managing your information
Edit your profile directly or reauthenticate with Google or Apple at /delete-account to leave. Linked Apple accounts require Apple verification to request revocation. Contact help@kihya.com about guest deletion or access issues. Never send authentication codes or tokens. Guests can use Guest progress → Delete guest progress in the game menu to delete server records and that guest’s drafts in this browser. Files on other devices and rotating backups may remain temporarily.
09Younger players and safety
The web and apps ask neutrally for an age band, not a date of birth. Users under 18 or of unknown age play as guests with house rewarded ads only. They cannot enter or publish names, emails, photos, country or Instagram details. Social sign-in, friend invitations, external sharing, channel links, external ad SDKs, optional analytics and Apple ad attribution are unavailable to them. Random guest identifiers and game, reward and security records serve internal game operations only, including saving progress and preventing duplicate rewards. Age is self-declared; this is not verification of a parent’s identity or legal consent. Report child data concerns or request deletion at help@kihya.com.
10International processing and changes
Sign-in, public profiles, external sharing, optional analytics and external ads described below are available only to users who select age 18 or over. Analytics is optional. With consent, visits, sign-ins, stages and reward events plus a separate random analytics identifier are sent to Google Analytics. Nicknames, emails, Instagram and auth tokens are excluded. Event and user retention is 14 months, with user retention reset on new activity. Decline anytime in Analytics settings. Ad personalization is off. With an adult app user’s consent, Firebase Analytics and Crashlytics process usage and crash diagnostics. iOS Apple ad attribution also requires this consent. A temporary attribution token stays in secure device storage for up to 24 hours; the server keeps only a deduplication hash and campaign results for up to 90 days. App settings provide the ad provider’s privacy options when required.
11Profiles that feel welcoming
For profile safety, we store an account or guest identifier, the target profile, report reason and status, and block records. Resolved reports are retained for 30 days and guest blocks for up to one year. Related records are deleted with account deletion. Privacy contact: help@kihya.com.