Effective from: October 2026
This policy covers the website kefkas.studio (Part A) and our apps (Part B, currently Idle CRISPR Tycoon). Section 1 and the sections on your rights apply to both. If the English and German versions differ, the German version prevails.
1. Data controller
kefkas studio e.U.
Neue Bienengasse 5/12
8020 Graz, Austria
Email: support@kefkas.studio
Phone: +43 316 811467
Part A – Website
2. Data we collect
- Beta sign-up (Idle CRISPR Tycoon page): email address, chosen platform (iOS or Android), time and IP address of the sign-up
- Contact by email: your email address and the content of your message
- Server logs: IP address, browser type, time of visit, pages visited
- Web tools usage counter: When you open a tool, only its name is reported to our server. We store nothing but the number of uses per tool and day – no IP address, no cookies and no identifier of individual visitors. The texts and files you work on in the tools never leave your browser.
- Cookies: see section 6
The beta sign-up is used solely to send you an invitation to test the app (iOS: TestFlight invitation to your Apple ID; Android: enrolment in the Google Play testing programme with the email address of your Google account). For this we pass your email address to Apple or Google. We store the IP address only to detect abuse.
3. Legal basis
- Art. 6(1)(a) GDPR: consent (beta sign-up). You can withdraw your consent at any time by emailing support@kefkas.studio.
- Art. 6(1)(b) and (f) GDPR: handling your enquiries by email
- Art. 6(1)(f) GDPR: legitimate interests (security and operation of the website, abuse prevention, anonymous counting of tool usage)
4. Retention
- Beta sign-up: until the end of the beta test or until you withdraw your consent; then we delete the data
- Email enquiries: until your enquiry has been dealt with, unless a statutory retention obligation applies
- Server logs: 30 days
- Usage counter: daily figures for about one year; these are plain numbers without any personal reference
5. Recipients
- Web hosting and email: easyname GmbH, Austria
- Delivery of the beta sign-up: your sign-up (email address, platform, time, IP address) is sent to us via a Telegram bot. The provider is Telegram (Telegram Messenger Inc.). Telegram also processes data in countries outside the EU for which there is no adequacy decision by the European Commission; an equivalent level of data protection may not be guaranteed there. The transfer is based on the explicit consent you give when signing up (Art. 49(1)(a) GDPR). Telegram privacy policy
- Beta invitation: Apple (TestFlight) or Google (Google Play), see section 2
6. Cookies
The website does not set any cookies and does not use any analytics or tracking services. Fonts and scripts are loaded exclusively from our own server.
7. External links
The website contains links to external websites. Their operators are responsible for their data protection.
Part B – App “Idle CRISPR Tycoon” (iOS and Android)
8. Overview
Idle CRISPR Tycoon is a game without user accounts. There is no registration and no transfer of your save game to us. We use Google Firebase as a processor for usage analytics and crash reports (section 15). For the global leaderboards and Plague Duels we use Unity Gaming Services (section 11). Some features also use services from Apple, Google and Unity; the following sections explain which data this involves.
9. Save game and cloud save
Your save game is stored locally on your device.
- iOS: If cloud save is enabled in the settings (default: on), the app stores a copy of your save game in your iCloud storage (Apple, linked to your Apple Account). We have no access to it. Apple’s privacy policy applies.
- Android: If cloud save is enabled and you are signed in to Google Play Games, your save game is stored as a “saved game” in your Google account. We have no access to it. Google’s privacy policy applies.
You can turn off cloud save at any time in the app’s settings.
10. Game Center and Google Play Games
Achievements and leaderboards are reported to Game Center (Apple) or Google Play Games (Google) if you are signed in there. Signing in is optional; the game works fully without it. Only the identifiers of unlocked achievements and three scores (total in-game earnings, era reached, Genome Merge minigame record) are sent. Apple and Google process and display them under their own terms.
11. Global leaderboards, player profile and Plague Duels (Unity Gaming Services)
So that players on iOS and Android can share leaderboards and challenge each other to duels, the app uses services from Unity Technologies (Unity Authentication, Leaderboards, Cloud Save, Cloud Code). On first launch the app signs in to Unity anonymously; this creates a random player identifier that is stored only on your device. No email address, real name or contact details are requested.
Leaderboards and player profile
- Player name: generated automatically at first (“Researcher#1234”), and after the tutorial optionally chosen by you. It is visible to others in the leaderboards. Please do not use your real name.
- Scores on the global leaderboards (e.g. total earnings, era reached, minigame records, duel points).
- Public player profile: game statistics such as exhibits, highest era, location, number of achievements and minigame stars – visible when someone taps your leaderboard entry.
- Reports: you can report inappropriate player names. We store the reported name and the identifiers of the reporting players; after several reports the name is hidden.
Plague Duels
After your first Outbreak Alert you can challenge other players to duels. For this we store a duel profile on Unity’s servers: player name, friend code, duel points, wins/losses, the list of your duels (at most the last 30), friends and block list, your language setting (for notification texts), your time zone offset (for the daily limits) and – only if you have allowed notifications – your push token, so we can tell you about challenges and results (sent via Firebase Cloud Messaging, see section 14). For each duel we store the result (people saved, play time, mistakes), the time and, if sent, one of the five fixed reactions (“GG!” etc.). There is no free chat. You can block players and report player names.
Leaderboards restart every month; the previous month’s entries are archived. Open duels expire after 48 hours. You can delete your duel profile including history and leaderboard entry at any time in the Duel Center via “Delete duel profile”. For all other Unity data (player name, profile, leaderboards) an email with your player name and number (e.g. “Researcher#1234”) is enough, see section 17.
The legal basis is the performance of the contract of use (Art. 6(1)(b) GDPR) – leaderboards and duels are features of the game – and, for the push token, your consent (Art. 6(1)(a) GDPR). Unity processes the data on our behalf and may transfer it to the USA on the basis of the EU Standard Contractual Clauses. More information: Unity – Game Player and App User Privacy Policy.
12. Advertising (optional bonus videos)
The app shows no forced ads and no banners. Only when you tap “Watch video” yourself (e.g. for free gene serum) is an ad video served through the Unity LevelPlay mediation platform. Only Unity’s own ad networks are connected (Unity Ads and ironSource Ads). The provider is Unity Technologies (for the EU: Unity Technologies ApS, Niels Hemmingsens Gade 24, 1153 Copenhagen, Denmark).
When loading and showing ads, Unity processes, among other things: device identifiers (on Android the Google Advertising ID, on iOS the identifier for vendors IDFV; Apple’s advertising ID IDFA is not requested), IP address, device type and operating system, language, approximate location derived from the IP address, and information about the app and your interaction with the ad. Unity may transfer data to the USA, based on the EU Standard Contractual Clauses.
At first launch the app asks whether Unity and its ad networks may use this data to show you ads that fit you (personalised ads). No ads are loaded before you answer. The legal basis for personalised ads is your consent (Art. 6(1)(a) GDPR, § 165(3) Austrian Telecommunications Act 2021). You can change or withdraw it at any time in the app’s settings under “Personalized ads”. Without consent, only non-personalised ads are served; the processing needed for that (delivery, fraud prevention, reach measurement) is based on our legitimate interest in funding the free app (Art. 6(1)(f) GDPR). On iOS the app does not request tracking permission (App Tracking Transparency); there is no tracking across other companies’ apps.
Provider privacy notice: Unity – Game Player and App User Privacy Policy (covers Unity Ads and Unity LevelPlay)
13. In-app purchases
Purchases (e.g. gene serum packs) are handled exclusively by the App Store (Apple) or Google Play (Google). We receive no payment data. To confirm a purchase, the app processes the receipt supplied by the store (transaction ID) on the device. Purchasing uses Unity In-App Purchasing (Unity Technologies); technical transaction data (product ID, transaction ID, device identifier) may be sent to Unity (Unity’s privacy policy).
14. Notifications
Notifications are only sent if you turn them on in the app (via the in-game invitation or in the settings) and grant your device’s permission.
Reminders (“Your lab is waiting”, “Research complete”) are local notifications that the app schedules on your device. No data is transferred for them.
News from the developer (e.g. new events or updates) are sent via Firebase Cloud Messaging (Google Ireland Limited). Only after you turn notifications on, your device creates a random push identifier (token), which is stored by Google and – on iOS – by the Apple Push Notification service so that messages can be delivered. The token contains no names or contact details. We do not send advertising this way. If you have unlocked Plague Duels, we also use the same token to tell you about new challenges, results and duels about to expire (section 11). If you turn notifications off in the app, the token is deleted. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the app or in your device settings. Google may transfer data to the USA on the basis of the EU Standard Contractual Clauses.
15. Analytics and crash reports
Usage analytics – only with your consent
At first launch the app asks whether we may record how the game is used. Only after you say “Yes” do we enable Google Firebase Analytics (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). It then records game events (e.g. location reached, task completed, tutorial step, purchase completed, bonus video watched), device type, operating system, app version, language, approximate region (derived from the IP address; Google does not store the IP address itself permanently) and a random app instance ID. No names, no email address, no save game. Advertising identifiers are not used for analytics, and the data is not used for advertising.
Legal basis: your consent (Art. 6(1)(a) GDPR, § 165(3) Austrian Telecommunications Act 2021). You can withdraw it at any time in the app’s settings under “Share usage data”; after that, nothing more is sent. Retention at Google: 2 months for event data.
Crash reports – Firebase Crashlytics
So that we can find and fix bugs, the app sends a report to Firebase Crashlytics when it crashes or hits a serious error: error log, device model, operating system version, app version, free memory, time, a random installation ID and the most recent game steps (e.g. “location 3 loaded”, “purchase started”). No names, no save game. This happens independently of your analytics consent, based on our legitimate interest in a stable app (Art. 6(1)(f) GDPR); retention at Google is 90 days. We also receive crash reports via Apple or Google if you have agreed to share them in your system settings.
Google processes this data on our behalf (Firebase data processing terms) and may transfer it to the USA, based on the EU Standard Contractual Clauses and Google LLC’s certification under the EU-US Data Privacy Framework. More information: Firebase privacy, Google privacy policy.
16. Children
The app is not specifically directed at children under 14. We do not knowingly collect personal data from children under 14.
Website and app
17. Your rights and data deletion
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and the right to withdraw consent at any time. To have your app data deleted, send an email to support@kefkas.studio with the subject “Delete data – Idle CRISPR Tycoon”. Because the app has no accounts, we can only assign data to you with the help of details you provide (e.g. device model and approximate time of use). We then delete the analytics and crash data held for you in Firebase and – if you tell us your player name and number – your data at Unity (player name, profile, leaderboard entries, duels) within 30 days. You can also delete your duel profile yourself in the app. Crash reports are deleted automatically after 90 days and analytics event data after 2 months in any case. Save games stored in iCloud or Google Play Games are in your own account and can be deleted there. Please direct requests about data that Apple, Google or Unity process for their own purposes to those providers; we are happy to help. Contact: support@kefkas.studio
18. Right to lodge a complaint
You can lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at
19. Changes to this policy
We update this policy when the website or app changes (e.g. new ad networks). The current version is always on this page.
Last updated: 29 October 2026