KOMOJI Privacy Policy

Last updated: 7 October 2026

1. Who is responsible for your data?

KOMOJI is published by Studio Vaxa, SASU with a share capital of €1,000, 47 rue Vivienne, 75002 Paris, SIREN 130 725 781, France. For any question about your data: komoji [at] studiovaxa [dot] com.

2. The data we process

The first time you open KOMOJI, it automatically creates an anonymous profile for you, without asking you anything.

Profile: an anonymous identifier, a temporary username (like "Moji-AB12CD", which you can change) and an invitation code.
Games: the words you guess, the result (won or lost), the duration, the date, your Sprints, your streak and the statistics calculated from them.
Friends: friend requests sent and received, and your friends.
Email address (optional): if you create an account or sign in, we use your address to send you a 6-digit code. There is no password.
Email fingerprint (optional): an irreversible code (SHA-256) calculated from your address, so that friends who have you in their contacts can find you. You can turn it off in "What your friends can see". Your address cannot be recovered from this code.
Contacts (optional): only if you use contact search, KOMOJI reads your contacts' email addresses on your phone, turns them into irreversible fingerprints on your phone, and sends only those fingerprints (2,000 at most) to find out which of them play KOMOJI. Neither the addresses nor your address book are kept.
Settings: language, keyboard and display are stored on your phone only.
Technical data: IP address, date and type of requests, kept in our hosting provider's logs for security and for the proper working of the service.
Advertising: KOMOJI shows ads provided by Google AdMob, never during a game. To show them, Google may receive your phone's advertising identifier, your IP address, information about your device and about how you interact with the ads. In the European Economic Area, the United Kingdom and Switzerland, a message asks for your consent before personalized ads; on iPhone, the tracking permission is requested. You can refuse or change your choice at any time in your phone's settings. More information: policies.google.com/technologies/partner-sites.

We do not collect your location, phone number, photos, microphone or health data. At this time, KOMOJI contains no usage analytics tool.

3. Why we use this data

To run the game (your profile, games, streak, friends, rankings) and to send you your sign-in code: this is necessary to provide the service.
To let you find your friends through your contacts, and to be found: with your consent (your phone's "Contacts" permission and the switch in the privacy settings).
To protect the service (limits against abuse, security logs): our legitimate interest in keeping KOMOJI safe.
Advertising: to show ads and, with your consent, personalized ads.

4. What other players see

Your username is visible in the rankings. Depending on what you chose in "What your friends can see", your friends can see your streak, your result of the day and your statistics. You can also choose whether you can be found by your username and by your email.

5. Who we share data with

We do not sell your data. We use service providers only to run KOMOJI:

Supabase: hosting of the database and the game functions, in the European Union (Ireland).
Resend: sending the emails that contain your sign-in code.
GitHub: daily backups of the database, kept for 14 days.
Google AdMob: displaying ads (see above).
Apple and Google: distribution of the app in their stores.

Some providers may process data outside the European Union, with the safeguards required by law (for example standard contractual clauses).

6. How long we keep your data

We keep your data as long as your profile exists. You can delete everything at any time from Settings, with "Delete my account" (or "Delete my data" if you have no email account). Deletion is immediate and irreversible: profile, games, Sprints, streak, friends and email address are erased. Backup copies may remain for 14 days at most, then disappear. Technical logs are kept for 1 day.

7. Your rights

You can ask for access to your data, to have it corrected (you can change your username yourself), erased (directly in the app), to receive it in a portable form, to restrict its processing, and to object to its processing. Where processing is based on your consent, you can withdraw it at any time. To exercise your rights: komoji [at] studiovaxa [dot] com. If you believe your rights are not respected, you can contact the data protection authority of your country (in France: the CNIL, cnil.fr).

8. Children

KOMOJI is not intended for children under 16. We do not knowingly collect data about them. If you think a child has created a profile, write to us and we will delete it.

9. Security

Exchanges with our servers are encrypted (HTTPS), data is hosted in the European Union and access to the database is limited.

10. Changes to this policy

If we change it significantly, we will tell you in the app. The date of the last update is at the top of this text.

11. Contact us

komoji [at] studiovaxa [dot] com