Privacy policy

Effective 1 October 2026. Last updated 1 October 2026.

Kulgames makes games. We do not run accounts, we do not have a server that stores anything about you, and we do not sell personal information. The only company that receives data about you through our games is Google, through the advertising in the phone versions. This page explains exactly what that means.

1. Who this covers

This policy is issued by [LEGAL ENTITY] ("Kulgames", "we"), of [POSTAL ADDRESS], Singapore. For the purposes of the EU and UK General Data Protection Regulation we are the data controller for the processing described here.

It applies to the kulgames.ai website and to Trapfall on iOS, Android, the Chrome Web Store and the web. If we release more games, this policy covers them too unless a game says otherwise.

Contact us about anything on this page at privacy@kulgames.ai.

2. What happens on each platform

The answer genuinely differs by version, so here it is in full:

The website loads no fonts, scripts, trackers or images from anyone else. Nothing about your visit is sent to a third party, and we keep no server logs that identify you beyond what our hosting provider retains for security and abuse prevention.

3. Data stored on your device

Our games save your progress locally: which floor you reached, which floors you cleared, your best time per floor, a total death count, and any cosmetic items you have unlocked. Depending on the version this uses your browser's local storage, the Chrome extension storage area, or the app's own private storage.

This never leaves your device. We cannot read it, and there is no copy of it anywhere else. Deleting the app, clearing the site's browser storage, or removing the extension erases it permanently — there is nothing to restore, because there was never an account.

Under the EU ePrivacy Directive, storing this counts as strictly necessary to provide the service you asked for, so it does not require consent. We use no cookies of any kind, and no storage for analytics or advertising outside the ad network described in section 4.

4. Advertising in the phone apps

The iPhone and Android versions of Trapfall show advertising supplied by Google AdMob. This is the only third-party code in the apps and the only route by which data about you leaves your device.

To serve and measure ads, Google may collect and process:

• your device's advertising identifier (the IDFA on iOS, the Advertising ID on Android)
• your IP address, which indicates approximate location such as city or region
• device and system information: model, operating system version, language, screen and network characteristics
• interaction with the ads themselves: what was shown, whether it was viewed, tapped or dismissed
• an indication of which app the request came from

We do not receive any of this in a form that identifies you. What we see is aggregate reporting: totals for impressions, clicks and revenue. We cannot identify a specific player from it.

Google acts as an independent controller for this processing. What it does with the data is governed by its own terms, which you can read here:

• Google Privacy Policy
• How Google uses data from sites and apps that use its services
• AdMob and advertising personalisation

Consent, and the difference it makes

If you are in the EEA, the UK or Switzerland, the app shows Google's consent message the first time you open it, before any ad request is made, and we go further than the message requires: we request non-personalised ads for those regions regardless of what you answer. Your advertising identifier is not used to build a profile or to target you. Ads are chosen from the context of the app instead. Declining the message entirely is also fully supported and the game is identical either way — there is no paid tier you are being pushed towards.

On iOS, Apple's App Tracking Transparency prompt asks separately whether we may access your device's advertising identifier for tracking. Declining is fully supported — ads become non-personalised.

Everywhere else, ads are personalised by default unless your device settings say otherwise, and you can change that at any time using the controls in section 7.

5. What we never do

• We do not ask for your name, email address, phone number or date of birth.
• We do not have user accounts, logins or cloud saves.
• We do not sell personal information, and we do not share it for cross-context behavioural advertising outside the AdMob processing described above.
• We do not use analytics, crash reporting, attribution or heatmap tools.
• We do not track you across other apps or websites ourselves.
• We do not build profiles about you or make automated decisions that affect you.

6. Children

Our games are not directed to children under 13, and they are not listed in any children's or family category on the App Store or Google Play. We do not knowingly collect personal information from children under 13, in the sense of the US Children's Online Privacy Protection Act, or under 16 where local law sets that age.

If you believe a child has provided personal information through one of our games, contact privacy@kulgames.ai and we will act on it promptly. In practice there is very little to act on: the games ask for nothing and store nothing off your device.

7. Your choices

You can change what advertising data is used, at any time, without contacting us:

On iPhone or iPad

• Settings → Privacy & Security → Tracking — turn off tracking for Trapfall, or for all apps.
• Settings → Privacy & Security → Apple Advertising — turn off personalised ads system-wide.

On Android

• Settings → Google → Ads — delete or reset your advertising ID, or opt out of ad personalisation.

Inside the game (EEA, UK and Switzerland)

• Reinstalling the app makes the consent message appear again, letting you change your answer. If you want your consent choice reset without reinstalling, email us and we will tell you how for your version.

Everywhere

• Deleting the app or extension removes all locally stored data and stops all processing.

8. Legal bases (EEA and UK)

• Consent — Art. 6(1)(a). This is the basis for personalised advertising and for storing or accessing information on your device for advertising purposes. You may withdraw it at any time using section 7; withdrawal does not affect processing already carried out.
• Legitimate interests — Art. 6(1)(f). This covers showing non-personalised advertising to fund a free game, and basic security and abuse prevention by our hosting provider. We have assessed that these do not override your rights, because the data involved is minimal and is not used to profile you.
• Performance of a contract — Art. 6(1)(b). Saving your progress on your own device so the game works as you expect.

9. Your rights

Depending on where you live, you have some or all of the following rights. We honour them for everyone, wherever you are, rather than only where the law compels us.

If you are in the EEA or the UK

Under the GDPR and UK GDPR you may request access to your personal data, correction, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests. You may also withdraw consent at any time. You have the right to lodge a complaint with your national supervisory authority — in the UK, the Information Commissioner's Office.

We do not serve personalised advertising to players in the EEA, the UK or Switzerland. Ads in those regions are non-personalised: they are chosen from the context of the app rather than from anything about you, and they do not build a profile. This is set at the ad-network level and does not depend on you finding a setting.

If you are in California

Under the CCPA as amended by the CPRA you may request to know what personal information has been collected about you, request its deletion, request correction, and opt out of its sale or sharing. Section 9a sets out the statutory categories in full.

We do not sell personal information, and we have not sold any in the preceding 12 months. Serving personalised advertising through AdMob does count as sharing for cross-context behavioural advertising under that law, and we have shared personal information for that purpose in the preceding 12 months in the phone apps only. You can stop it with the device controls in section 7, or with the opt-out below.

We do not collect sensitive personal information as that law defines it, so the right to limit its use does not arise. We do not use personal information for profiling that produces legal or similarly significant effects. We will never discriminate against you for exercising a right — the game is identical either way.

An authorised agent may make a request on your behalf with written permission from you; we may ask you to confirm it directly.

If you are in another US state

Comprehensive privacy laws are now in force in a number of US states, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Tennessee, Maryland, Indiana, Kentucky and Rhode Island. If you live in one of them you generally have the right to confirm whether we process your personal data, to access, correct and delete it, to obtain a portable copy, and to opt out of targeted advertising. We honour all of these.

Targeted advertising is the only one of these activities we engage in, and it happens only in the phone apps. Section 7 turns it off.

Appeals. If we refuse a request, we will tell you why in writing and you may appeal by replying to that email with the word "appeal" in the subject line. We will review the decision and respond within 45 days, and if we still refuse we will give you a means of contacting your state Attorney General.

We recognise the Global Privacy Control browser signal on this website as a valid opt-out request where state law requires it. The website serves no advertising, so in practice there is nothing for the signal to switch off here.

If you are somewhere else

We apply the rights described above to everyone, whichever country you are in. That includes players in jurisdictions with their own data protection statutes — among them Malaysia (PDPA 2010), Indonesia (PDP Law), Thailand (PDPA), Vietnam (PDPD), the Philippines (Data Privacy Act), India (DPDP Act 2023), Japan (APPI), South Korea (PIPA), Australia (Privacy Act), Canada (PIPEDA), Brazil (LGPD) and South Africa (POPIA). If your local law gives you a right not listed here, write to us and we will honour it.

If you are in Singapore

Under the Personal Data Protection Act you may request access to personal data in our possession, request correction, and withdraw consent to its collection, use or disclosure.

How to exercise any of this

Email privacy@kulgames.ai. We respond within 30 days, or sooner where the law requires it, and we will tell you if we need a short extension and why. There is no charge.

Verifying who you are. Because we hold no account, we have no way to check a request against a record. We will ask only for what is needed to act on it — usually the platform you play on and, for an advertising request, your device's advertising identifier. We use anything you send solely to handle the request and delete it afterwards. We will never ask for a copy of your ID.

9a. Categories of personal information (US disclosure)

US state laws ask for this in a specific, enumerated form. All of it concerns the advertising in the phone apps; the website, the web game and the Chrome extension collect none of it.

Retention. We retain none of the above, because none of it reaches us in identifiable form — we see only aggregate impression and revenue totals. Google's retention is set by its own policies, linked in section 4. Game progress on your device is kept until you delete it.

Do not sell or share my personal information

We do not sell personal information. To stop the sharing that personalised advertising involves, use the control for your device — it takes effect immediately and applies to every app, not just ours:

• iPhone or iPad: Settings → Privacy & Security → Tracking → turn off for Trapfall.
• Android: Settings → Google → Ads → Delete advertising ID, or opt out of ad personalisation.

Or email privacy@kulgames.ai with "opt out" in the subject and we will confirm in writing. No account is needed and we will not ask you to create one.

10. International transfers

We are based in Singapore. Google processes advertising data on infrastructure in several countries, including the United States. Where data is transferred out of the EEA or the UK, Google relies on the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. We hold no personal data ourselves, so we make no transfers of our own.

11. Retention

Data on your device stays until you delete the app, the extension, or your browser storage. We retain nothing about individual players, because we receive nothing about individual players. Google's retention of advertising data is governed by its own policies, linked in section 4.

12. Security

Our games make no authenticated network calls and transmit nothing about you beyond the ad requests described here. The website is served over HTTPS. The strongest security measure here is structural rather than technical: there is no database of players to breach, because we never built one.

13. Changes

If we add anything that changes what is collected — analytics, leaderboards, accounts, a different ad network — we will update this page and change the date at the top before that version ships. Material changes will also be noted on the store listing. Continuing to play after a change means you accept the updated policy.

14. Contact

Privacy questions and rights requests: privacy@kulgames.ai
Everything else: support@kulgames.ai

[LEGAL ENTITY], [POSTAL ADDRESS], Singapore.