Privacy Policy for the app “Cohopp”

Last updated: 13 November 2026

1. Controller

Vu Thanh Tung (VTTBox)
Thôn Bằng Quân, Xã Cẩm Giang
Thành phố Hải Phòng, Vietnam
Email: support@vttbox.com

2. In short

• You can play Cohopp without signing up. On first launch the app creates an anonymous account.
• At the moment we show no ads and use no tracking services.
• We send usage statistics and crash reports only if you agree. You can change this anytime in Settings.
• We do not sell data.
• You can delete your account in the app at any time: Settings → Account → Delete account (also under Profile).

3. What data we process

3.1 Player account (Firebase Authentication)

On first launch the app signs you in anonymously. For this, Firebase Authentication (Google) processes a random user ID and technical connection data such as your IP address.

If you choose to link your account with Google, so it carries over to another device, we receive your Google account ID, email address and name from Google. On iPhone you can use Sign in with Apple instead: we then receive your Apple account ID and an email address from Apple (if you choose "Hide My Email", a relay address Apple creates). We show the email address only to you, on your Profile. When you delete your account, we also revoke Cohopp's access to your Apple ID.

• Purpose: running your account and keeping your progress across devices.
• Legal basis: Art. 6(1)(b) GDPR (providing the app).

3.2 Player profile on our server

With your user ID we store:

• the player name you choose (up to 16 characters);
• your coins, and the items you bought or unlocked (boards, frames, emotes);
• the profile picture and look you chose;
• game statistics: games, wins, online wins, pieces sent home, and daily counters for rewards;
• when the profile was created and changed.

The purpose is providing the game's features. The legal basis is Art. 6(1)(b) GDPR. We keep the profile until you delete your account.

3.3 Online rooms with friends

When you create or join a private room, our server processes:

• the room code;
• your player name, profile picture and look, which the other players in the room also see;
• your moves and the emotes you send.

Room data is deleted automatically:

• 10 minutes after the room is empty;
• 1 hour after the game ends;
• at the latest 24 hours after the last activity.

The legal basis is Art. 6(1)(b) GDPR.

3.4 IP address and abuse protection

Our server runs on Cloudflare. Your IP address is processed technically so that the app can reach the server. We also use it briefly to limit the number of requests per address, for example when rooms are created. We do not store IP addresses in our database.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is secure and stable operation.

3.5 Remote settings (Firebase Remote Config)

The app loads a few settings from Firebase Remote Config, such as a notice that an update is required, or the links to these legal texts. For this, Firebase processes an installation ID of the app, the app version and the platform.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is keeping the app up to date and working.

3.6 Usage statistics and crash reports (only with your consent)

On first launch the app asks whether you want to share usage statistics and crash reports. Without your consent none of this is sent. You can change your choice anytime under Settings → Usage stats & crash reports; withdrawing consent applies from then on.

• Firebase Analytics (Google): events in the app such as a game starting or ending, the number of finished games and purchases in the shop with coins, plus an ID of the app installation, device model, operating system, app version, language and approximate country. Advertising IDs (IDFA, Android advertising ID) are not collected. The data is not used for advertising. Google keeps it for up to 14 months.
• Firebase Crashlytics (Google): when the app crashes, a report with the stack trace, device model, operating system, app version and an ID of the app installation. Google keeps crash reports for 90 days.

The purpose is to find bugs and improve the game. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

3.7 Only on your device

Your settings (sound, vibration, language, motion effects, tips) and a game in progress against the computer are stored only on your device. This data is not sent to us.

3.8 What we do not collect

We do not access your location, contacts, photos, camera or microphone.

4. Recipients and processors

We use these service providers, under data processing agreements:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA: Firebase Authentication, Firebase Remote Config and, with your consent, Firebase Analytics and Crashlytics.
• Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA: server (Workers, Durable Objects) and database (D1).
• Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland: Sign in with Apple, only if you use it.

Data may be transferred to the USA. Both companies are certified under the EU-US Data Privacy Framework. The European Commission's Standard Contractual Clauses also apply.

5. Deleting your account

You can delete your account under Settings → Account → Delete account (also under Profile). We then immediately delete:

• your profile on our server, with coins, items and statistics;
• your Firebase account.

The app then starts a new, empty anonymous account. Purchased content is lost.

You can also ask for deletion by email to support@vttbox.com.

6. Your rights

Under the GDPR you have the right to:

• access (Art. 15);
• rectification (Art. 16);
• erasure (Art. 17);
• restriction of processing (Art. 18);
• data portability (Art. 20);
• object to processing based on Art. 6(1)(f) (Art. 21).

You may also complain to a data protection supervisory authority, for example the one where you live.

For requests, write to support@vttbox.com. Include your player name and, if you linked Google or Apple, the email address of that account, so we can find your account.

7. Children

Cohopp is not specifically aimed at children. We do not knowingly collect data from children beyond what the game's features need.

8. Changes

When we add new features, we update this policy. This applies, for example, to ads, in-app purchases or crash reports. Where required, we ask for your consent in the app first.