Privacy Policy

This Privacy Policy explains how Pixel IT s.r.o. (“Pixel IT”, “we”), a company incorporated in the Slovak Republic (registered office: Kaplnská 1219/18, 925 22 Veľké Uľany; Company ID (IČO) 50 999 192; entered in the Commercial Register of the District Court Trnava, section Sro, insert no. 40379/T), processes personal data in connection with the “Chroma Eye” game for iOS and Android and the website at chromaeye.pixelit.io (together, the “App”). Pixel IT is the data controller. Privacy contact: chromaeye@pixelit.io.

1. Our approach in short

2. Data stored on your device only (not sent to us)

Your games and rounds (the target colors and your picks), scores, bests, streaks, Daily and weekly results, progress, Insights, reports, your training plan, challenge codes you received, and your settings are stored in the App’s local storage on your device. This information is not sent to us. It is removed when you uninstall the App or clear its data, and Reset progress in the App’s settings removes your games and results (your settings and purchases stay).

We do not keep a copy. Your device’s own backup (for example Android backup to your Google account, or an iCloud or computer backup of your iPhone or iPad) may include this data, under Google’s or Apple’s terms.

3. Data processed when you use the App

a) Product analytics — Google Analytics for Firebase

App opens, screen views, taps on buttons and controls, game events (for example the mode you played and how the game ended), session length and frequency, a Firebase installation identifier, device model, operating-system and App version, language, and coarse region derived from the IP address (we do not store the IP address). Used to understand how the App is used and to improve it. In the EEA, the United Kingdom and Switzerland, the App passes your consent choices to Firebase. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR) in operating and improving the App, and, where required, your consent (Art. 6(1)(a) GDPR).

b) Crash and stability diagnostics — Google Firebase Crashlytics

Crash and error stack traces, device state and memory at the time, operating-system and App version, a crash installation identifier and optional diagnostic log breadcrumbs. Used to find and reduce crashes. Legal basis: legitimate interest in a stable and secure App.

c) App configuration — Google Firebase Remote Config

The App downloads settings from Google (for example feature switches and how often ads may appear). The request carries a Firebase installation identifier, the App version, the platform, and the language and country of your device. Legal basis: legitimate interest in operating the App.

d) Advertising — Google AdMob (unless you have Remove ads or Pro)

The App shows native ads on the game summary, occasional full-screen ads after finished games, and optional rewarded ads that run only when you choose to watch one. AdMob processes the advertising identifier (Android Advertising ID, or the iOS IDFA where you allow it), coarse location derived from IP, ad requests, impressions, clicks and interactions, and device and app signals, to select, deliver, cap the frequency of, and measure ads, and to detect invalid activity.

In the EEA, the United Kingdom and Switzerland we show a Google-certified consent message before any ad is requested; on iOS the App Tracking Transparency choice governs use of the IDFA. If you decline, you may still see ads, but they are non-personalized. If you have Remove ads or Pro, the App shows no ads and requests none. Legal basis: your consent (Art. 6(1)(a) GDPR) for personalized ads and any tracking; legitimate interest for non-personalized ads, frequency capping and fraud prevention. Ad networks act as independent controllers for the ads they deliver.

e) Purchases — App Store, Google Play and RevenueCat

Payments are processed by the Apple App Store or Google Play. We use RevenueCat to check which of your purchases are active on your device. RevenueCat receives the store receipt or purchase token, transaction identifiers, the products and their status (for example an active subscription, a trial or a one-time purchase), an anonymous app user identifier created by the App, and your device’s platform, App version and store country. From the stores we also receive aggregate sales reports. We never receive your card or bank details. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and legitimate interest in preventing abuse.

f) Leaderboards and achievements — Game Center and Google Play Games

If you are signed in to Game Center (iOS) or Google Play Games (Android), the App sends your scores and achievements to that service. Apple or Google may show them, with your player name and picture from that service, to other players according to your settings there. We do not receive your Apple or Google account details. These services are run by Apple and Google under their own privacy policies; you can sign out in your device or game-service settings. Legal basis: legitimate interest in providing the features you choose to use.

g) Notifications

Reminders (for example that a new Daily Challenge is out) are scheduled locally on your device after you allow notifications. No push token is created and nothing is sent to a server for this. You can turn reminders off in the App or in your device settings.

h) Friend challenges and sharing

A challenge code or link contains a game’s mode, the information needed to replay its colors and the challenger’s score. It contains no name or identifier. When you share a code, result or image, you pick the app and the recipients in your device’s share sheet; we do not receive what you share. Opening a challenge link loads a page from our website (see below). On Android, if you install the App from a challenge page, Google Play passes the challenge code to the App on its first start (Install Referrer); the App uses it only on your device to open the challenge.

i) If you contact us

If you email chromaeye@pixelit.io or info@pixelit.io, or send feedback from the App (which opens your own email app), we receive your email address and whatever you write. Used to answer you. Legal basis: legitimate interest in handling requests / taking steps at your request.

j) Website

This website is static. It sets no cookies, runs no analytics, stores nothing in your browser and loads no third-party scripts, fonts or embeds. The color round on the home page runs only in your browser; nothing about it is sent anywhere.

Our hosting provider records standard server logs (IP address, date and time, the requested page, the referring page and your browser’s user agent) for security and operation, and keeps them only for a short period. The “Notify me at launch” button opens your own email app; if you send the message, we receive your email address and what you write, and use it only to tell you when Chroma Eye launches and to answer you. Legal basis: legitimate interest in running a secure website; for launch notes, your request, which you can withdraw at any time by writing to us.

4. Who we share data with

We use the following recipients, each under its own terms and, where they act as our processor, a data processing agreement:

• Google Ireland Limited / Google LLC — Firebase Analytics, Crashlytics, Remote Config, AdMob, Google Play and Google Play Games;
• Apple Inc. / Apple Distribution International Ltd — App Store distribution, purchases and Game Center;
• RevenueCat, Inc. — checking purchase status;
• our website hosting provider;
• advertisers and ad networks reached through AdMob, as independent controllers for ad delivery and measurement.

We may also disclose data if required by law, to protect our rights, or in connection with a merger, acquisition or reorganization of our business.

5. International transfers

Google, Apple and RevenueCat may process data in the United States and other countries outside the EEA. Such transfers rely on the European Commission’s Standard Contractual Clauses and/or an adequacy decision (including the EU–US Data Privacy Framework) where applicable, together with supplementary measures as needed.

6. How long we keep data

• On-device data — until you delete it, use Reset progress, clear the App’s data or uninstall.
• Firebase Analytics — event-level data retained for 14 months; aggregated reports may be kept longer.
• Crashlytics — crash reports retained for about 90 days.
• Remote Config and AdMob — per Google’s retention schedule.
• RevenueCat and purchase records — for the life of the purchase and then as long as tax and accounting law requires (up to 10 years in Slovakia).
• Emails (support, feedback, launch notes) — up to 24 months after the matter is closed.
• Website server logs — a short period set by our hosting provider.

7. Your rights

Under the GDPR you have the right to access your data, to have it rectified or erased, to restrict or object to processing (including processing based on our legitimate interests, and any direct marketing), to data portability, and to withdraw any consent at any time without affecting prior processing. You can change your ad-consent choices in the App, and use your device settings to reset or limit the advertising identifier, refuse tracking, or turn off notifications.

To exercise a right, email chromaeye@pixelit.io. Because we generally hold no information that identifies you by name, we may be unable to find data relating to you unless you give us identifiers that link it to you (for example a purchase order number from your store receipt). In that case, under Art. 11 GDPR, some rights may not apply. You also have the right to lodge a complaint with the Slovak supervisory authority, the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk), or with the authority in your EU country of residence.

8. Children

The App is made for a general audience and is not directed to children under 16 (or the age of digital consent in your country), and we do not knowingly collect their personal data. Ads are limited to content suitable for a general audience. If you believe a child has provided us data, contact us and we will delete it.

9. Security

We apply reasonable technical and organizational measures to protect data, and we rely on the security of Google, Apple and RevenueCat for the services above. However, no method of transmission or storage is completely secure and we cannot guarantee absolute security.

10. Changes

We may update this Policy at any time. The current version is always the one published on this page, with the “last updated” date changed accordingly, and an update takes effect as soon as it is posted. We do not send any individual notice of changes — not by email, in-App message, notification or any other channel. Please review this page from time to time. Continued use of the App after an update is posted means you accept the updated Policy.

11. Contact

Pixel IT s.r.o., Kaplnská 1219/18, 925 22 Veľké Uľany, Slovak Republic (IČO 50 999 192; IČ DPH SK2120554106). Privacy contact: chromaeye@pixelit.io. General: info@pixelit.io.