Privacy

What we store, and why

Short version: an email address so you can sign in, what you bought, and a salted hash of the IP that clicked an ad. We run no trackers and no ad networks, and we sell nothing. We do load each advertiser's logo from wherever they host it — see “Advertisers' logos” below. Last updated 2026-09-05.

Who holds the data

KOD.AI, Warsaw, Poland
info@kodai.com.pl

If you have an account

Your email address, so we can send the sign-in link. That is the only mail we send, and it is the only thing we ask for.
Your handle, if you set one. It is public: it appears on your bubbles and in the Rush leaderboard. Until you set one, the board calls you “Player” and four characters derived from your account id — never any part of your email address.
Your bubbles — name, tagline, link, logo URL, colour, price — which are public by design.
Your credit ledger: top-ups, tax, buyouts, defense fees, game rewards.
Your game scores and saved Merge board.

If you only look

Browsing the tank and playing the games needs no account and stores nothing about you on our servers. Advertisers' logos are the exception, and they are loaded by your browser, not stored by us.
When you click through to an advertiser we record the bubble, the time, and a SHA-256 hash of your IP address and user agent, salted and rotated daily. We never store the address itself, and the hash stops being a match for you the next day. It exists to count one visitor once and to reject bots.
Your browser keeps a few things locally that never leave it: your game bests and saved boards, whether sound is muted, whether you collapsed the intro, and the dates you visited (used to decide when to show the daily extras).

Advertisers' logos

A bubble is painted with the advertiser's own logo, and the advertiser supplies the address it lives at. We do not copy or cache those images, so your browser fetches each one straight from the server that hosts it — the advertiser's own site, or an image host they linked to, such as Spotify's or YouTube's. Rendering the tank therefore shows those servers your IP address, your browser's user agent and the fact that you came from this site, exactly as any page with an image on it would. On a normal visit that is a handful of hosts, and it happens before you click anything.

We have no arrangement with any of them, we get nothing back, and nothing they see reaches us. A content blocker, or a browser set to block third-party images, stops it: the tank still works and falls back to the advertiser's initial and colour. We would rather serve these images from our own servers; until we do, this paragraph is the accurate description.

Cookies

One session cookie, set when you sign in, so the site knows it is you. No analytics or advertising cookies — there is nothing to consent to because we do not run any.

Who else sees it

Polar, our merchant of record, handles the payment and gets the email address you check out with. We never see your card.
Our email provider, to deliver the sign-in link, and our hosting and database providers, to run the site.
The servers that host advertisers' logos, as described above. They see the request your browser makes for the image; we send them nothing.
Nobody else. We do not sell data and we do not run third-party trackers.

How long, and your rights

Account data stays while the account exists. Click records are aggregate counts plus the daily-rotating hashes described above.
Write to info@kodai.com.pl to see, correct, export or delete your data, or to close the account. Deleting an account removes the email address and the ledger; bubbles you sold stay in the tank under their new owner.
You can complain to the Polish data protection authority (UODO) if you think we handled your data badly.