Privacy Policy

Chroma 12 · Last updated: 22 July 2026

This Privacy Policy explains what information Chroma 12 collects, how it is used, and your rights in relation to it. Chroma 12 is operated by Ninki Gen Studio, based in Singapore ("we", "us", "our").

We are committed to handling your data minimally and transparently, in accordance with the Singapore Personal Data Protection Act 2012 (PDPA) and, where applicable, the UK/EU General Data Protection Regulation (GDPR).

1. What We Collect and Why

Anonymous Session ID

When you play Chroma 12, a random anonymous identifier (UUID) is generated for your device and stored securely via Supabase. This contains no personal information — no name, email address, or contact details. We use it solely to remember your unlocked cosmetics and game progress across sessions.

Bot and Spam Prevention

To prevent automated abuse of our sign-in system, we use Cloudflare Turnstile, a privacy-preserving CAPTCHA alternative. Turnstile briefly evaluates certain device and browser signals to confirm you are not a bot. It does not use tracking cookies for advertising, and we do not receive any personal information from this process beyond a pass/fail verification result. See Cloudflare's Privacy Policy.

Push Notification Subscription

If you choose to enable push notifications, your browser generates a push subscription endpoint — a browser-specific token — which is stored on our server. This allows us to send you game updates and notifications. To send notifications at a relevant time (for example, a daily-streak reminder in your local evening) and avoid over-notifying you, we also store your device's IANA timezone, when you were last active, your current daily-streak count and dates, and timestamps of notifications already sent to you. None of this data identifies you personally. You can withdraw consent at any time by disabling push notifications within the game.

Referrals

If you share your personal invite link with a friend and they play using it, we record a link between your anonymous session and theirs so that we can credit your referral and, where applicable, notify you that it was completed. No personal information is exchanged between you and the referred player through this process.

Anonymous Gameplay Analytics

We use PostHog, a product-analytics tool, to understand how features like powers, abilities, and badges are used in aggregate. This is configured to avoid persistent tracking: it does not use cookies, does not build a cross-session profile, and is not linked to your Supabase session ID. See PostHog's Privacy Policy.

Error Diagnostics

If the game encounters an unexpected error, we use Sentry to automatically capture technical diagnostic information (such as your browser type and the location in our code where the error occurred) so we can identify and fix bugs. This may include your IP address, as collected by Sentry's infrastructure. See Sentry's Privacy Policy.

Local Game Data

Your scores, coins, settings, and game progress are stored in your browser's local storage. This data never leaves your device and is not accessible to us.

Advertising

We display advertisements through Google AdSense to help fund free access to Chroma 12. Google and its advertising partners may use cookies and similar technologies to serve ads and, where you have given consent, to personalise them based on your activity. If you are located in the European Economic Area, the UK, or Switzerland, a consent banner will ask for your permission before any personalised-advertising cookies are set; if you decline, you will still see ads, but they will not be personalised. See Google's Advertising Policy and manage your ad personalisation settings at Google Ads Settings.

Chroma Originals TikTok Launch Campaign

If you participate in the Chroma Originals TikTok Launch Campaign, you will voluntarily submit your email address and TikTok profile URL to us for the purpose of verifying your entry and delivering your reward code. This information is used solely for those purposes and is not shared with any third party. See our Challenge T&Cs for full campaign details.

Player Feedback Survey

If you choose to complete our optional player feedback survey, your rating and any free-text feedback are collected via Google Forms. The form does not request your name or email address, and responses are not linked to your anonymous session ID — please avoid including personal information in your written feedback. By submitting the form, you agree that your feedback may be used anonymously (never attributed to you by name or account) in our marketing materials, such as social media, app store listings, or promotional content. See Google's Privacy Policy for how Google Forms itself handles submissions.

2. Legal Basis for Processing (GDPR)

Anonymous session ID: Legitimate interest — necessary to provide persistent in-game features such as unlocked cosmetics.
Bot prevention (Turnstile): Legitimate interest — necessary to protect the sign-in system from automated abuse.
Push subscription endpoint: Consent — you explicitly opt in to receive notifications.
Player activity and timezone data: Legitimate interest — necessary to deliver the push notifications you've consented to at a relevant time, and to avoid over-notifying you.
Referral linkage: Consent — you and the referred player each voluntarily initiate this by sharing or using an invite link.
Anonymous gameplay analytics (PostHog): Legitimate interest — to understand feature usage and improve the game.
Error diagnostics (Sentry): Legitimate interest — to detect and fix bugs.
Advertising cookies (Google AdSense): Consent — for visitors in the EEA, UK, and Switzerland, obtained via our consent banner before ad cookies are set. Elsewhere, our legitimate interest in funding free access to the game.
Campaign email and TikTok URL: Consent — you submit these voluntarily by entering the campaign.
Player feedback survey: Consent — completing the survey is entirely optional, and the marketing-use disclaimer is disclosed on the form itself before you submit.

3. Data Retention

Anonymous session ID: Retained until you request deletion.
Push subscription endpoint: Retained until you unsubscribe or the endpoint becomes invalid, at which point it is automatically removed.
Player activity and timezone data: Retained alongside your anonymous session ID, until you request deletion.
Referral linkage: Retained until you request deletion.
Anonymous gameplay analytics (PostHog): Not linked to your persistent identity; retained per PostHog's own data retention policy.
Error reports (Sentry): Retained per Sentry's own data retention policy.
Advertising cookies (Google AdSense): Retained per Google's own cookie and data retention policies, which we do not control directly.
Campaign data (email address, TikTok URL): Retained for the duration of the campaign period plus 90 days, then permanently deleted.
Player feedback survey responses: Anonymous and not linked to your session ID; retained indefinitely for product-improvement and marketing purposes.

4. Third Parties

We use Supabase (supabase.com) as our backend database and authentication provider. Anonymous session IDs, push subscription endpoints, and the player activity data described above are stored on Supabase's servers. Supabase acts as a data processor on our behalf and does not use your data for its own purposes. See Supabase's Privacy Policy.

We use Cloudflare for website hosting, content delivery, and Turnstile (our CAPTCHA provider — see "Bot and Spam Prevention" above). See Cloudflare's Privacy Policy.

We use PostHog for anonymous, aggregate gameplay analytics (cookieless, no cross-session profiling — see "Anonymous Gameplay Analytics" above). See PostHog's Privacy Policy.

We use Sentry for automatic error monitoring and bug diagnosis (see "Error Diagnostics" above). See Sentry's Privacy Policy.

We use Google AdSense to display advertisements (see "Advertising" above). Google may use cookies to serve ads and, where you have consented, to personalise them. See Google's Privacy Policy and how Google uses advertising cookies.

We use Google Forms to collect optional, anonymous player feedback (see "Player Feedback Survey" above). See Google's Privacy Policy.

5. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Access: Request a copy of the data we hold about you.
Erasure: Request that we delete your data ("right to be forgotten").
Rectification: Request correction of inaccurate data.
Restriction: Request that we limit how we process your data.
Portability: Request your data in a structured, machine-readable format.
Objection: Object to processing based on legitimate interest.
Withdraw consent: Withdraw consent at any time where processing is consent-based (e.g. push notifications).

To exercise any of these rights, contact us at [email protected]. We will respond within 30 working days.

6. Data Security

We take reasonable technical measures to protect your data, including encrypted connections (HTTPS) and access-controlled database infrastructure via Supabase. No method of internet transmission is completely secure, and we cannot guarantee absolute security.

7. Children

Chroma 12 is suitable for all ages. We do not knowingly collect personal data from children under 13. If you believe a child has submitted personal data to us (for example, via the creator campaign), please contact us and we will delete it promptly.

8. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Continued use of the game after an update constitutes acceptance of the revised policy.

9. Contact

For any privacy-related queries: [email protected]

This policy is governed by the laws of the Republic of Singapore.