Provider / data controller: Kudbi Enterprise, Kazakhstan
Contact: [email protected]
1. Summary
SNAP SNAKE is a free, ad-supported casual puzzle/arcade game for a general audience. You do not need an account, and we do not need your name or email address to let you play. We work with analytics, crash-reporting, in-app advertising, and advertising-measurement providers that process device identifiers and app-usage data to operate, secure, monetize, attribute, and improve the game. On Android, you may see an on-device consent prompt that controls personalized advertising and non-essential measurement where legally and platform-permitted. After the applicable consent/analytics permission is available, the Android version may initialize the TikTok App Events SDK to measure installs, selected gameplay milestones, confirmed purchases, and impression-level ad revenue for TikTok campaign attribution and optimization. The TikTok SDK is not included or initialized on iOS. On iOS, this version uses non-personalized advertising with no IDFA-backed tracking, no App Tracking Transparency (ATT) prompt, and no custom tracking/consent prompt (ATT would apply only if IDFA-backed tracking is enabled in a later version).
2. Who we are
Kudbi Enterprise is the controller of personal data processed through SNAP SNAKE. Contact: [email protected] (privacy alias: [email protected]). EU/UK representative details (if and where required) are in Section 8.
3. Information we and our partners process
SNAP SNAKE is guest-only. We do not ask for your name, email, or phone to play, and the App has no camera, photo upload, microphone capture, contacts access, precise GPS, or user-generated content features. We and our service providers process:
| Category | Examples | Source |
|---|---|---|
| Advertising identifiers | GAID (Android, including advertising measurement where permitted); IDFA (iOS) only if IDFA-backed tracking is enabled in a later version (this version uses no IDFA-backed tracking) | Device |
| Analytics identifiers | Firebase installation / app-instance ID; SDK install UUIDs, including TikTok SDK identifiers on Android | Generated on device |
| Device & technical data | model, OS version, language, region, screen, coarse network, app version | Device |
| App-usage / gameplay events | runs, score/best/combo, level/Daily activity, streak and freeze status/outcomes, settings, ad & purchase events | In-app |
| Advertising interactions | impressions, clicks, rewarded completions, ad-revenue signals | Ad SDKs / TikTok App Events SDK (Android) |
| Advertising attribution / campaign events (Android) | install, launch, 2-day retention, first completed run, 3-run engagement milestone, Daily completion, confirmed “Remove Forced Ads” purchase value/currency/product ID, and impression-level ad-revenue value/currency/network/format/placement. We do not send names, email addresses, phone numbers, payment-card data, receipts, order IDs, or ad-unit IDs to TikTok. | TikTok App Events SDK (Android only) |
| Diagnostics | crash logs, stack traces, performance/ANR, breadcrumbs | Crash SDK |
| Purchases | “Remove Forced Ads” entitlement, store transaction IDs (no card/bank data) | Store |
| Approximate location | coarse region derived from IP address (not GPS) | Network / Ad SDKs |
| Support correspondence | if you email us: your email address, message content, and any information you choose to include | You |
IP addresses. SNAP SNAKE does not intentionally store raw IP addresses in its own systems. Our providers may process IP addresses to deliver their services, derive approximate (city/region-level) location, prevent fraud, maintain security, serve and measure advertising, run analytics, and comply with legal obligations.
Daily reminders and streak freeze. If you enable Daily Challenge reminders, the App schedules local notifications on your device when a Daily Challenge is ready, when an automatic renewable one-day streak freeze is active, or when the current Daily is the last chance to save a streak. Notification text may include the streak length stored locally on your device. These reminders are local/device notifications only. We do not use Firebase Cloud Messaging, APNs device push tokens, or a backend push-notification server for this feature. You can allow or deny notification permission in your device settings, and you can enable or disable Daily Reminders in the App settings. Declining notifications does not block gameplay.
4. Why we process data, and our legal bases (GDPR / UK GDPR)
| Purpose | Processing activity | Data categories | Legal basis |
|---|---|---|---|
| Provide the game; save local progress | Run the App; store scores/streaks/achievements/settings on your device | Gameplay/usage events, device/technical, local storage | Contract / steps at your request — Art. 6(1)(b); legitimate interests — Art. 6(1)(f) |
| Crash & stability diagnostics | Collect crash stacks, ANRs, performance, breadcrumbs (Crashlytics) | Diagnostics, device state, install UUID | Legitimate interests — Art. 6(1)(f); consent — Art. 6(1)(a) where required |
| Product analytics | Measure aggregate usage/retention (Firebase Analytics) | App-instance ID, usage/gameplay events, device/technical, coarse region | EEA/UK: Consent — Art. 6(1)(a) for non-essential analytics (collection stays disabled until consent). Outside the EEA/UK, or for strictly essential measurement: legitimate interests — Art. 6(1)(f). |
| Advertising attribution & campaign measurement (Android) | Use TikTok App Events SDK to measure app installs and selected in-app outcomes, evaluate TikTok campaign performance, and optimize advertising | GAID where available/permitted, SDK identifiers, IP/coarse region, device/technical data, install/launch/retention, selected gameplay milestones, confirmed purchase value/currency/product ID, impression-level ad-revenue fields | Consent — Art. 6(1)(a) where required, including EEA/UK non-essential measurement. Outside those regions, legitimate interests — Art. 6(1)(f), subject to applicable law, platform rules, and your device/app choices. |
| Remote app configuration (Android) | Retrieve cached and updated configuration values, including advertising-policy settings and emergency feature controls (Firebase Remote Config) | Firebase installation identifier, app/device technical data, and configuration-fetch metadata | Legitimate interests — Art. 6(1)(f) for safe, reliable app operation; consent — Art. 6(1)(a) where required for non-essential device storage or access. |
| Security & fraud / invalid-traffic prevention | Detect/prevent cheating, invalid ad traffic, abuse | Device IDs, ad-interaction signals, IP-derived signals (by providers) | Legitimate interests — Art. 6(1)(f); legal obligation — Art. 6(1)(c) where applicable |
| Personalized advertising | Serve personalized ads via AdMob mediation; forward consent to networks | GAID/IDFA, ad interactions, device signals, coarse location | Consent — Art. 6(1)(a) (Google UMP on Android; on iOS, ATT applies only if IDFA-backed tracking is enabled later — this version is NPA-only / no IDFA-backed tracking) |
| Non-personalized / contextual advertising | Serve non-personalized or contextual ads | Limited device/ad-request signals (no IDFA-based tracking) | EEA/UK: Consent — Art. 6(1)(a) where the ads use non-essential device storage or access (cookies, mobile identifiers, local storage, or similar). Where no such non-essential device access is used, and outside the EEA/UK: legitimate interests — Art. 6(1)(f). |
| Rewarded ads (optional in-game benefit) | Show an optional, player-initiated rewarded ad and grant the chosen in-game benefit, such as reviving an Endless run (or an in-game hint where available) | Ad interaction/completion signals; ad identifiers per consent | Ad serving follows the advertising bases above (EEA/UK: consent where non-essential device storage/access is used; personalization is always consent-based). Delivering the chosen in-game reward: legitimate interests — Art. 6(1)(f). |
| Purchases / “Remove Forced Ads” entitlement | Process the purchase; remember entitlement | Purchase/entitlement state, store transaction IDs | Contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c) for records/tax |
| Support requests | Respond if you contact support | Email address, message content, info you include | Legitimate interests — Art. 6(1)(f); contract/steps at your request — Art. 6(1)(b) |
EEA/UK device-access posture. Consistent with our consent-gated initialization (we keep Firebase Analytics collection disabled until consent, show the Google UMP prompt first where it applies (on Android / where legally required; not shown on iOS in this version), initialize the TikTok App Events SDK on Android only after the applicable consent/analytics permission is available and stop forwarding new TikTok events if consent is withdrawn, request iOS ATT only if/when IDFA-backed tracking is enabled in a later version (this version uses no IDFA-backed tracking), enable analytics and crash reporting per region after consent, and initialize ads only after consent is resolved and forwarded to every ad partner), in the EEA/UK non-essential analytics and any advertising that uses non-essential device storage or access rely on your consent — including non-personalized or contextual advertising that uses cookies, mobile identifiers, local storage, or similar device access. If you do not consent, or you withdraw consent, we do not use personalized advertising and we keep non-essential analytics disabled where consent is required. Non-personalized, contextual, or limited ads may be requested only to the extent permitted by applicable law and by the final Google UMP / Google Mobile Ads / mediation configuration. Where consent is required for non-essential device storage or access and is not given, those ad or analytics features may be unavailable or limited. We continue to rely on legitimate interests only for purposes that do not require non-essential device storage/access — such as security and fraud/invalid-traffic prevention, basic app operation, support requests, and, where applicable, crash diagnostics. Outside the EEA/UK, some non-personalized or contextual advertising may rely on legitimate interests rather than consent.
5. Advertising, partners, consent & tracking controls
We monetize with the Google Mobile Ads SDK and AdMob mediation. Because our advertising and advertising-measurement partners may change over time, we maintain a current, dated list — including their roles and policy links — on our Advertising Partners page. Our current in-app advertising partners are Google (AdMob / Google Mobile Ads / UMP) and Unity Ads (Unity Technologies). On Android, TikTok is an advertising attribution and campaign-measurement partner through the TikTok App Events SDK; TikTok does not serve ads inside SNAP SNAKE and the TikTok SDK is not included on iOS. Any additional mediated network or measurement partner will be listed there before activation.
- On Android, on first launch and where legally required, we show a Google UMP consent prompt that governs personalized advertising and, in the EEA/UK, non-essential analytics and advertising that uses non-essential device storage or access (including non-personalized or contextual ads that rely on such access).
- On Android, we may use consent-gated personalized advertising where legally and platform-permitted; where personalized ads are not permitted or consent is absent, ads fall back to non-personalized / contextual, then limited, then no ads.
- On Android only, after the applicable consent/analytics permission is available, selected app events may be shared with TikTok to attribute installs, measure campaign performance, and optimize TikTok advertising. The optional TikTok automatic UI-click/scene tracking feature is disabled; we send only the approved events described in Section 3.
- On iOS, this version uses non-personalized advertising with no IDFA-backed tracking, so no ATT prompt is shown, and it shows no Google UMP and no custom tracking/consent prompt. Ads may be non-personalized, contextual, limited, or unavailable depending on applicable law and the final SDK configuration. If IDFA-backed or cross-app tracking is enabled in a later version, we will request ATT before any such tracking and update this policy and our Apple privacy labels accordingly.
- You can reset your advertising ID or limit ad tracking in device settings, and change your consent choice in the App where available (Section 11).
In the current iOS build, Firebase Analytics collection remains disabled, Firebase Remote Config is not initialized, and the TikTok App Events SDK is not included or initialized. Crash diagnostics, where enabled under the App’s configuration and applicable consent requirements, and advertising SDKs may still process the limited signals described above.
6. Sharing and service providers
We share data only with the providers needed to run the game, each acting as an independent controller or our processor as applicable: Google (Firebase Analytics & Crashlytics, Firebase Remote Config on Android, AdMob/Google Mobile Ads/UMP, Google Play Billing), Unity Technologies (Unity Ads, Unity IAP), TikTok (Android App Events SDK for advertising attribution, campaign measurement, and optimization), Apple (App Store/StoreKit billing; ATT on iOS applies only if IDFA-backed tracking is enabled later), plus any advertising partner listed on our Advertising Partners page. We do not sell your personal information for money. Policy links: Google Privacy Policy, Firebase Privacy, AdMob Policy; Unity Privacy Policy; TikTok App Events SDK, TikTok Privacy Policy; Apple Privacy.
7. Retention
We retain data only as long as needed for the purposes above. Analytics retention is configured in our analytics console and may be adjusted over time; provider data is retained according to each provider’s policy and our configuration. Local progress remains on your device until you clear it or uninstall.
8. International transfers & representatives
Our providers may process data in countries other than yours, including the United States. Where required, transfers rely on appropriate safeguards (e.g. EU Standard Contractual Clauses) maintained by those providers. Where we are required to appoint a representative under Article 27 GDPR / UK GDPR, we will identify that representative in this section.
9. Your rights and how to exercise them
Depending on where you live, you may have rights to access, correct, delete, port, or restrict/object to processing, and to withdraw consent. Because SNAP SNAKE is guest-only, most data is either stored locally on your device or held by our providers under pseudonymous identifiers. To exercise rights or request deletion, email [email protected]; we will forward requests to the relevant providers and explain what we can and cannot remove (e.g. already-aggregated/anonymized data). You can also clear local progress in Settings and reset/limit your advertising ID on-device.
- EEA/UK (GDPR/UK GDPR): we respond within approximately 30 days (extendable as permitted by law). You may complain to your supervisory authority.
- US state privacy laws: we respond within approximately 45 days (extendable as permitted by law).
10. US state privacy disclosures
Residents of California (CCPA/CPRA) and other US states with comprehensive privacy laws (e.g. Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana) may have rights to know/access, delete, correct, and opt out of “sales”/“shares”/targeted advertising. We do not sell personal information for money; however, sharing advertising identifiers for cross-context behavioral advertising may be treated as a “sale” or “share”/“targeted advertising” under these laws. Opt out by declining personalized ads in the consent prompt, enabling “Limit Ad Tracking”/resetting your advertising ID, or contacting [email protected] (on iOS, denying ATT applies only if IDFA-backed tracking is enabled in a later version). We honor opt-out preference signals such as Global Privacy Control where legally required and technically available. We do not knowingly sell or share the personal information of consumers under 16.
11. Privacy choices / manage consent
You can change your consent for advertising and analytics where available through the App’s privacy/consent settings (re-opening the consent prompt) and through your device’s ad-tracking controls. On Android, where the consent prompt applies, you can re-open it in the App; withdrawing the applicable analytics/measurement permission stops new TikTok App Events from being forwarded. On iOS, this version does not show an in-app tracking/consent prompt or a “Manage Privacy Choices” row, because it does not use IDFA-backed tracking; you can still control ad tracking through your device settings. A “Privacy Choices” / “Do Not Sell or Share My Personal Information” control (where applicable) will be available in the App’s settings.
12. Children
SNAP SNAKE is a general-audience game and is not directed to children. It is not part of Google Play “Designed for Families” and not in the Apple Kids Category. We do not knowingly collect personal information from children under 13 (or the applicable age in your region). If you believe a child has provided us data, contact [email protected] and we will delete it.
13. Security
Data is transmitted over encrypted (HTTPS/TLS) connections, and our providers apply their own technical and organizational safeguards. No method of transmission or storage is 100% secure.
14. Changes
We may update this policy; material changes are reflected by a new “Last updated” date and, where appropriate, an in-app or store notice. The 2026-07-12 update added disclosures for Android Firebase Remote Config, renewable one-day Daily streak-freeze analytics, freeze-aware local Daily notifications, and the Android-only TikTok App Events SDK used for consent-gated advertising attribution, selected app-event measurement, confirmed purchase measurement, and impression-level ad-revenue reporting. It also clarifies that TikTok does not serve ads inside the game and is not included on iOS. The current list on the Advertising Partners page may be updated more frequently than this policy.
15. Contact
Kudbi Enterprise — [email protected] (privacy requests: [email protected]).