Kleio Privacy Policy
Last updated: 21 August 2026
Effective: on first public release of Kleio
Who we are
Kleio is a board game scorekeeping app published by Franklin Garcia Marin, an individual developer resident and domiciled in Costa Rica.
For the purposes of the EU/UK General Data Protection Regulation (GDPR), Franklin Garcia Marin is the data controller for the personal data described in this policy.
| Controller | Franklin Garcia Marin (individual) |
| Contact | support@fr4gus.com |
| Jurisdiction | Costa Rica |
We do not have a Data Protection Officer. Costa Rican and EU law do not require one for processing of this nature and scale. Write to support@fr4gus.com for anything covered by this policy.
The short version
Kleio keeps score for board games played around a table. To do that, it syncs a shared scoreboard between the devices of everyone in a session.
- You can use Kleio without creating an account at all — anonymous play is the default and collects no personal information about you.
- If you create an account, we store your email address and whatever display name you choose.
- We do not sell your personal information, and we do not show ads.
- We do not use analytics or advertising SDKs.
- Anything you type into a display name, a session name, or a gear item is visible to the other players in your session. Treat those fields as public.
Minimum age
You must be at least 13 years old to create a Kleio account.
The game itself is suitable for any age — it is a scorekeeper with no objectionable content. The account has an age floor because accounts carry a friend list and free-text fields that other users can see.
We do not knowingly collect personal data from anyone under 13. If we become aware that we have, we delete it. If you believe a child under 13 has created an account, contact support@fr4gus.com and we will remove it.
What we collect
If you play anonymously
Kleio's default and primary path is anonymous play — joining a session by code, link, or QR without signing up.
In this mode we assign your device an opaque, randomly generated identifier so the scoreboard knows which player you are. It is not linked to your name, email, phone number, or any other identifier, and it does not follow you to another device or survive reinstalling the app.
We still receive the technical data described under Data we receive automatically below.
If you create an account
| Sign-up method | What we receive |
|---|---|
| Email and password | Your email address. Passwords are handled by Google Firebase Authentication and are never visible to us. |
| Google Sign-In | Your email address, your Google account display name, and your Google account ID. |
We store, against your account:
- Display name — chosen by you, shown to other players and friends
- Friend code — a generated code others use to add you
- Last active time — used to show friends whether you are online
- Current session — which session you are seated in, if any, so friends can see you are playing and so you can rejoin after closing the app
- Account tier — free or paid
Game session data
While a session is running we store, for each session:
- The session name (typed by the host)
- The join code
- Which game template is in use
- Who is hosting, and the maximum number of players
- Creation, start, and expiry timestamps
- For each player: their scores and game statistics, and for Munchkin games, the names of gear items entered by players
- A running feed of scoring events — which player's score changed, who changed it, by how much, and when
Friends and invitations
If you use the friends feature we store your friend relationships (the other user's account identifier, the status of the relationship, and when it was established), along with pending friend requests, session join requests, and invitations.
Friendship is mutual by design: someone becomes your friend only when both sides agree. There is no searchable directory of Kleio users — a person can only find you if they already have your friend code.
Data we receive automatically
These are collected by the Google Firebase services Kleio runs on, on every request, whether or not you have an account:
- IP address
- Device and operating system information
- Timestamps of requests
We also use Google Play Integrity to confirm that requests come from a genuine, unmodified installation of Kleio rather than from an automated script. This sends device and app-integrity signals to Google. It exists to prevent abuse of our service, not to identify you, and we do not use it to build a profile of you.
Stored on your device only
Kleio stores your language preference on your own device. It is never transmitted to us.
What we do not collect
Kleio does not collect or access your location, contacts, camera roll, microphone, health data, financial data, or advertising identifiers. Kleio does not contain any analytics or advertising SDK. Kleio does not track you across other apps or websites.
Content other people can see
This is the most important thing to understand about Kleio.
Your display name, the session name the host types, and any gear item names entered during a Munchkin game are broadcast in real time to every other player in that session. Your display name and online status are also visible to your accepted friends and to anyone you have a pending friend request with.
Do not put personal information — your full legal name, address, phone number, email, or anything you would not tell a stranger — into these fields. We cannot recall content once other players' devices have received it.
Why we process your data, and on what legal basis
For users in the EU, UK, and other GDPR jurisdictions:
| What | Why | Legal basis |
|---|---|---|
| Anonymous device identifier | To run a shared scoreboard at all | Performance of a contract (Art. 6(1)(b)) |
| Email and password / Google account | To create and secure your account | Performance of a contract (Art. 6(1)(b)) |
| Display name, friend code, presence | To provide the friends and multiplayer features you asked for | Performance of a contract (Art. 6(1)(b)) |
| Session, score, and feed data | To keep and sync the scoreboard | Performance of a contract (Art. 6(1)(b)) |
| IP address, device data, Play Integrity | To keep the service secure and prevent abuse | Legitimate interests (Art. 6(1)(f)) |
| Records of deletion requests | To show we complied with the law | Legal obligation (Art. 6(1)(c)) |
We do not rely on consent for any of the above, because none of it is optional to the functioning of the app. We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
Who we share it with
We do not sell your personal information. We have never sold it, and we do not share it for cross-context behavioural advertising.
Your data is shared only with:
Other Kleio users, as described under Content other people can see.
Google LLC, as our infrastructure provider. Kleio runs entirely on Google Firebase — Authentication, Cloud Firestore, Cloud Functions, and Play Integrity. Google processes this data on our instructions as a data processor. See Google's Firebase privacy documentation at https://firebase.google.com/support/privacy.
Law enforcement or regulators, where we are legally required to disclose. We will not volunteer your data absent a valid legal obligation.
We use no other third-party service. There are no advertising networks, analytics vendors, data brokers, or marketing platforms in Kleio.
Where your data goes
Kleio's Firebase infrastructure stores data on Google servers, which may be located outside Costa Rica and outside your country of residence, including in the United States.
For transfers of EU/UK personal data, Google LLC relies on the European Commission's Standard Contractual Clauses, which we incorporate through our Firebase data processing terms. Costa Rican transfers are made on the basis of your provision of data for a service you have requested, consistent with Ley 8968.
How long we keep it
Honest disclosure: session data is not currently deleted automatically.
Each session records an expiry timestamp 24 hours after creation, but we have not yet built the process that acts on it. Until we do, session records — including scores, feed entries, and session names — persist indefinitely on our infrastructure.
We are building automated deletion. This policy will be updated with a concrete retention period when it ships, and we will not claim a retention period we are not actually enforcing.
Account data is kept for as long as your account exists. When you ask us to delete your account, we delete it as described below.
Your rights
Depending on where you live, you have some or all of the following rights. We honour all of them for all users regardless of location — it is simpler and fairer than checking your jurisdiction first.
- Access — a copy of the personal data we hold about you
- Rectification — correction of inaccurate data
- Erasure — deletion of your account and associated data
- Restriction — pause our processing while a dispute is resolved
- Portability — your data in a machine-readable format
- Objection — object to processing based on legitimate interests
- Withdraw consent — where processing rests on consent (currently none does)
Californian residents additionally have the rights to know, delete, correct, and opt out of sale or sharing under the CCPA/CPRA. We do not sell or share personal information, so there is nothing to opt out of. We will not discriminate against you for exercising any right.
How to exercise them
Email support@fr4gus.com from the address associated with your account, or including your friend code if you signed in with Google. For deletion specifically you can also use the web form — see "Deleting your account" below.
We respond within 30 days. There is no charge unless a request is manifestly unfounded or excessive.
Deleting your account
You can request deletion of your account in two ways, and both are handled the same way:
- Use the web form at kleio.fr4gus.com/delete-account. You do not need the app installed to use it.
- Or email support@fr4gus.com from the address associated with your account.
We confirm by email before deleting anything — this prevents someone else from deleting your account by guessing your address — and we complete the deletion within 30 days of your request.
Deletion removes your account record, your display name and friend code, your friend relationships on both sides, your pending requests and invitations, and your player entries in sessions.
Two limits worth stating plainly:
- Scoring events already sent to other players' devices cannot be recalled. Feed entries in a shared session are part of another player's record of their own game.
- Sessions you hosted may persist for the other players in them.
We are still building a deletion button inside the app itself. This policy will be updated when it ships. Requests made through the web form or by email are honoured in full in the meantime — the absence of an in-app button does not reduce your rights.
Reporting abuse
Kleio does not yet have an in-app block or report button. If another user is harassing you or has entered abusive content into a display name, session name, or gear item, email support@fr4gus.com with the offending content and, if you have it, the person's friend code. We will investigate and can remove accounts that violate our terms.
In-app blocking and reporting are planned. This policy will be updated when they ship.
Security
Access to your data is controlled by server-enforced security rules — players can only read and write the sessions they are seated in, and account records are readable only by you and by people you have an existing friendship or pending request with. Sensitive fields such as your account tier and friend code can only be written by our backend, not by any client. All traffic is encrypted in transit. Passwords are managed by Google Firebase Authentication and are never stored or visible to us.
No system is perfectly secure. If we discover a breach affecting your personal data, we will notify you and the relevant supervisory authority where the law requires it.
Advertising and analytics
Kleio currently contains no advertising and no analytics. No AdMob, no Firebase Analytics, no Crashlytics, no third-party tracker of any kind.
We may add limited advertising or crash reporting in future. If we do, we will update this policy and the Play Store Data Safety disclosure before that version ships, not afterwards.
Changes to this policy
We will post any changes here and update the "Last updated" date. For changes that materially affect your rights — new data collection, a new category of recipient, advertising — we will notify you in the app before they take effect.
Complaints
If you are in the EU or UK, you may lodge a complaint with your national data protection authority.
In Costa Rica, the supervisory authority is the Agencia de Protección de Datos de los Habitantes (PRODHAB), https://www.prodhab.go.cr.
We would appreciate the chance to resolve it first: support@fr4gus.com.
Contact
Franklin Garcia Marin Email: support@fr4gus.com Costa Rica
A postal address will be added to this policy once established.
This page is generated from docs/legal/privacy-policy-en.md in the Kleio source repository. Do not edit it directly.