Privacy Policy

Effective date: October 9, 2026

This policy explains what the Quill & Star app and this website collect, why, who else handles it, how long it’s kept, and the choices you have. It covers the app on iPhone, iPad and Android, and the website at quill-and-star-game.web.app. It starts with a short summary and then gives the details.

Who we are

Quill & Star is made by KHKikani, an independent developer based in India. KHKikani decides how the personal data described here is used, which makes KHKikani its “controller” under data protection laws. In this policy, “we”, “us” and “our” mean KHKikani.

• Email: harshitkikani9081@gmail.com
• Phone: +91 95122 03345 (India Standard Time, UTC+5:30)

The short version

• No account, no sign-up. The app never asks for your name, email address, phone number or location.
• Your game stays on your phone. Puzzles are made on your phone, and your progress, streaks and settings are saved there. We don’t keep a copy.
• Free, with ads from Google. To show and measure ads, Google AdMob collects device information such as your IP address and your device’s advertising ID (on iPhone and iPad, only if you allow tracking; on Android, unless you delete it).
• Usage and crash reports, which you can turn off. To improve the game and fix crashes, the app sends usage statistics and crash reports to Google Firebase. They’re tied to random identifiers, not to your name or email. They’re on when you install the app, and you can turn them off at any time in Settings > Privacy > Share usage and crash reports. In the EEA, the UK and Switzerland, Analytics stores its identifiers on your phone only if you agree in Google’s consent form; until then, it still sends usage statistics, but without any identifier.
• Your say over ads. Where privacy laws require it, the app shows Google’s consent form for ads, and Settings shows “Privacy choices” so you can change your answer. To know whether they apply where you are, the app checks with Google each time it starts. On iPhone and iPad, you decide whether the app may track you.
• A quiet website. This website sets no cookies, runs no analytics or ads, and loads nothing from other companies’ servers.

What we collect and why

The app has no server of its own. Except for what ads themselves send to Google’s ad partners (see “Advertising”), everything the app sends goes to Google, through the services below.

Usage statistics (Google Analytics for Firebase)

While “Share usage and crash reports” is on, the app sends notes on how the game is played:

• the puzzles you start, solve, save for later or leave, with each puzzle’s size and grade, the time on the clock, and how many mistakes and hints there were;
• which kind of solving step a hint explained;
• how far you read in the how-to-play guide;
• milestones, such as a 7-day streak or 25 puzzles solved, and attempts to save a streak;
• settings you change, such as the edition, sound or the reminder time you pick (switching sharing off is never sent, because sending stops first);
• that you tapped Share (not what you shared or with whom), that the app asked the store for a rating, and that you opened the app from the daily reminder;
• ad events: when a rewarded ad is offered and whether you chose to watch it, and when an ad is shown or closed;
• a few labels that sum up your play: roughly how far you are in the puzzle book, your streak length in ranges, whether you play the daily puzzle, the book or both, whether reminders and sound are on, which edition you use, and whether ads are on.

Google Analytics also records some things by itself: the first launch, sessions and time spent in the app, the pages you visit, app updates, the app version, your device model, operating system and language, and your approximate location (such as country or city), which Google works out from a shortened form of your IP address. Google says Google Analytics doesn’t log or store IP addresses. Google’s ads software may also report each ad impression, and what it earned, to Analytics.

These notes are tied to a random app-instance ID that Analytics creates for this installation, and, where your device makes it available, to your device’s advertising ID (on iPhone and iPad, only if you allow tracking). In the EEA, the UK and Switzerland, Analytics doesn’t store or read these identifiers on your device until you agree in Google’s consent form (see “Your choices”).

Until you agree there, and while sharing is on, the app still sends the usage statistics above, but without the app-instance ID or the advertising ID, and without storing or reading any identifier on your phone. They aren’t tied to an identifier for your installation, so we can’t link them to each other or to your device. Google uses them for totals and to estimate the numbers it can’t measure directly. The same happens anywhere if, on the very first launch, the app can’t learn within a few seconds which rules apply where you are: its first notes are sent this way, and the identifiers are used once the app knows that no consent is needed.

On a new installation, no usage statistics are sent until the app has applied your “Share usage and crash reports” setting and either learned which privacy rules apply where you are or waited a few seconds for that answer.

We don’t collect your name, email, phone number, contacts, precise location or anything you type. We never set a user ID, and Google signals is turned off, so Analytics doesn’t link your play to a Google account.

Why: to learn which puzzles are too hard or too easy, where players get stuck, whether hints, reminders and streaks help, and how ads affect play. We don’t use these notes to target ads.

Crash reports (Firebase Crashlytics)

While “Share usage and crash reports” is on, a crash or error sends a technical report: the error and where in our code it happened, the app’s state at that moment, your device model, operating system and app version, free memory and storage, screen orientation, and a random Crashlytics installation ID. Each report also carries a few notes: which page was open, the kind of build, whether ads were on, short notes on the last steps (such as the pages visited), and the most recent usage statistics described above.

Why: to find and fix what made the app stumble.

When you turn sharing off, the app records no errors at all, and crash reports still waiting on your phone are deleted.

On a new installation, crash reporting starts once the app has applied your setting, a moment after it first opens. If the app crashes before then, the report waits on your phone and is sent the next time the app starts with sharing on.

Remote settings (Firebase Remote Config)

Each time the app starts, and sometimes when you come back to it, it asks Firebase for its current settings. Today these are about ads: whether ads are on, which ad units to load, how far apart full-screen ads are, and how many puzzles come before the first one. To answer, Firebase receives a random Firebase installation ID, your device’s country and language settings, time zone, operating system version, the app’s ID and version, the Firebase software version, and a label saying this is a store build. While sharing is on, Firebase can also use the usage labels above to decide which settings apply, for example a longer ad-free start for new players.

Why: the app needs these settings to work, and they let us adjust ads without an app update. For that reason this runs even when “Share usage and crash reports” is off.

Checking which privacy rules apply (Google’s consent software)

Each time the app starts, and when you come back to it while ads aren’t running, it asks Google’s consent software (the User Messaging Platform, which comes with Google’s ads software) whether privacy laws where you are call for your consent, and whether Settings must offer “Privacy choices”. If it gets no answer, for example because you’re offline the first time you open the app, it asks again a few times over the next few minutes. This happens whether or not ads are on, and whether or not “Share usage and crash reports” is on. The check shows nothing by itself and doesn’t start Google’s ads software.

To answer, Google receives:

• your IP address, which Google uses to work out your general region;
• basic details about your device and the app: your device model, operating system and its version, language and screen size, the app’s ID and version, and the version of Google’s consent software;
• the privacy choices that Google’s consent software has already stored on your phone.

The check doesn’t include your device’s advertising ID. Google uses these details to decide which message, if any, applies to you and to run the check. Google’s software keeps the answer, and any choices you make in its form, on your phone.

Why: we need to know whether to ask for your consent before ads, and the answer also decides whether Analytics may store its identifiers on your phone (see “Usage statistics”). For that reason this runs even when “Share usage and crash reports” is off.

Advertising (Google AdMob)

Quill & Star is free because it shows ads:

• a banner at the foot of the home, calendar and puzzle book pages;
• sometimes a full-screen ad after you solve a puzzle, never during one, and never in your first three puzzles;
• rewarded ads only when you choose one, for a hint, one more try after three mistakes, or a streak freeze.

While ads are on, Google’s ads software collects:

• your IP address, which may be used to estimate your general location;
• your interactions with the app and its ads, such as app launches, ad taps and video views;
• diagnostic information about how the app and the ads software perform;
• device identifiers: on Android, the advertising ID and the app set ID; on iPhone and iPad, the advertising identifier only if you allow tracking, plus identifiers tied to this app or developer.

Google and its ad partners may store and read information on your device (much as cookies work on the web), and may use web beacons and IP addresses, to collect information as a result of serving ads in the app. Google uses this information to show ads, limit how often you see the same one, measure results, prevent fraud and, where you allow it, personalize ads. We ask Google to show only ads suitable for a general audience.

Google acts as an independent controller of the data it collects for ads. Read How Google uses information from sites or apps that use our services and the Google Privacy Policy. We see only totals in AdMob, such as how many ads were shown and what they earned, never who you are.

If we switch ads off, Google’s ads software doesn’t start, and neither the consent form nor the tracking prompt appears by itself. The app still makes the check described in “Checking which privacy rules apply”, and Settings still shows “Privacy choices” where the rules call for it, so you can review or change answers you gave before.

Things that stay on your phone

The app saves these in its private storage on your phone. This data itself never leaves your phone, although while sharing is on, the usage statistics above describe some of it, such as your streak range:

• your settings: sound, vibration, edition, clock, automatic crossing out, region patterns, reminders and their time, and your choice about sharing usage and crash reports;
• your progress: the next puzzle in the book, puzzles solved, best times for each size, daily results, streak freezes, and counts of hints and perfect solves;
• unfinished puzzles saved for later;
• a few small notes: whether the how-to-play guide has been shown, which app version last asked for a rating, and which milestones have already been counted.

Your answers to Google’s consent form and to the iPhone tracking prompt are also kept on your phone, by Google’s software and by iOS.

Your phone’s own backup, such as iCloud or Google backup, may include this storage depending on your settings. We don’t back it up or sync it anywhere, so we can’t restore it for you.

Daily reminder. If you turn on the daily reminder, the app asks your permission to send notifications, and your phone shows the reminder at the time you choose. It’s scheduled on your phone; no server sends it.

Sharing a result. Share opens your phone’s share sheet with a short, spoiler-free note: the puzzle’s number or date, its grade and size, your time, your mistakes and any hints, and a link to this website. You choose where it goes, and we never see it.

Ratings. When the app asks for a rating, the rating sheet belongs to Apple or Google, and they handle your answer under their own policies. We see only reviews that are published in the store.

When you contact us

If you email or call us, we receive your email address or phone number and whatever you tell us. We use it only to answer you and to keep a record of what you asked. Our email is provided by Google (Gmail).

This website

This website is hosted by Google on Firebase Hosting. It sets no cookies, uses no similar tracking technologies, and runs no analytics, ads or trackers. Everything on it, fonts included, comes from this site, so your browser doesn’t contact any other company while you read it.

Like any web server, Firebase Hosting receives your IP address and the standard details your browser sends with each request, such as the page’s address and the browser type, so it can deliver the page. Google uses request IP addresses to detect abuse and to give us total visitor numbers, and keeps IP data for a few months. We don’t use it to identify you.

Links to the App Store or Google Play take you to Apple’s or Google’s sites, where their own privacy policies apply.

Who we share it with

• Google, as our service provider. Google provides Firebase (Analytics, Crashlytics, Remote Config and Hosting) and processes that data on our behalf. In the language of the GDPR, Google is our processor; under California law, our service provider. See Privacy and Security in Firebase.
• Google and its ad partners, for ads. Google AdMob collects the advertising data described above as an independent controller, under its own privacy policy. The check on which privacy rules apply also goes to Google, through its ads software.
• Apple and Google, as app stores. They handle downloads, updates and ratings under their own policies.
• When the law requires it. We may disclose information if we must by law, or to protect the rights, property or safety of our players, ourselves or others.
• If the app changes hands. If Quill & Star is ever transferred to someone else, the information described here may go with it, and this policy’s promises will still apply to it.

We don’t sell your information for money, and we don’t give it to data brokers. Some US state laws call advertising like AdMob’s a “sale” or “sharing”; see “California” and “Other US states” below.

We confirm that the third parties named in this policy, Google and its Firebase and AdMob services, are bound by their own terms and policies to protect your data with the same or equal protection described here.

Legal bases for using your data

If you’re in the European Economic Area (EEA), the United Kingdom or Switzerland, we rely on these legal bases:

• Usage statistics: your consent, given in Google’s consent form, for Analytics to store and read identifiers on your device, which you can change at any time in Privacy choices; and our legitimate interest in understanding how the game is played and improving it, which also covers the statistics sent without identifiers before you agree, and to which you can object at any time with the Settings switch.
• Crash reports: our legitimate interest in finding and fixing problems. You can object at any time with the Settings switch.
• Remote settings: providing the app you asked for, and our legitimate interest in running it reliably.
• Ads: where Google’s consent form asks for it, your consent to storing and reading information on your device and to personalized ads. Showing ads to keep the game free is our legitimate interest.
• Checking which privacy rules apply: complying with the law, and our legitimate interest in asking for consent only where it’s needed.
• Daily reminder: your permission, which you can withdraw at any time.
• Emails and calls: our legitimate interest in answering you, or taking the steps you asked for.
• The website: our legitimate interest in delivering it safely.
• Legal obligations: where a law requires us to keep or disclose something.

You don’t have to give us any information. Without usage sharing, the game works exactly the same. The advertising data is what lets ads appear, and ads are how the game stays free.

We don’t make decisions about you by automated means that have legal or similarly significant effects. Google uses automated systems to choose which ads to show.

Your choices

• Share usage and crash reports. Settings > Privacy > Share usage and crash reports. It’s on when you first install the app. Turning it off stops usage statistics and crash reports at once and deletes crash reports still waiting on your phone. The app remembers your choice. It doesn’t affect ads, remote settings or the check on which privacy rules apply. Information already sent is kept until it expires (see “How long we keep information”).
• Google’s consent form. In the EEA, the UK and Switzerland, Google’s consent form appears by itself before ads start, only while ads are switched on. You can agree or decline; the game works either way, although Google may then show limited ads. In these places, Analytics doesn’t store or read identifiers on your device (its app-instance ID, or your advertising ID) until you agree in Google’s form, and it keeps its advertising features (ad user data and ad personalization) off unless you agree. Until then, while sharing is on, it sends usage statistics without those identifiers; turn sharing off to stop them too.
• Privacy choices. When Google’s rules call for it, such as in the EEA, the UK, Switzerland and certain US states, Settings shows “Privacy choices”, whether or not ads are on. It opens Google’s form, where you can change your choices: in the EEA, the UK and Switzerland, for ads and for Analytics’ identifiers on your device; in those US states, to opt out of the sale or sharing of your personal information for ads.
• Tracking on iPhone and iPad. While ads are on, the app asks once whether it may track you, never over a puzzle. If you choose Ask App Not to Track, the app can’t use your device’s advertising identifier, and you still get every feature. You can change this any time in Settings > Privacy & Security > Tracking.
• Advertising ID on Android. You can reset or delete your advertising ID in your phone’s Settings > Privacy > Ads (the exact place varies by phone). After you delete it, apps receive a string of zeros instead.
• Google’s ad settings. Google’s ad settings let you manage the ads you see and turn off ad personalization.
• Notifications. You can turn the daily reminder off in Settings > Reminders, or block notifications in your phone’s settings.
• Deleting the app. Deleting Quill & Star removes everything it stored on your phone. If you install it again, it starts with new random identifiers.

Step-by-step instructions are on Your data and how to delete it.

Children

Quill & Star is made for adults. It isn’t directed to children under 13, and we don’t knowingly collect personal information from children under 13 (or under the minimum age set where they live, such as 16 in some European countries). Ads in the app are limited to content suitable for a general audience. If you believe a child has used the app and information about them was collected, contact us and we’ll help, and see Your data and how to delete it.

How long we keep information

Where information is processed

We’re based in India. Google processes the information described here in data centers in many countries, including the United States. For transfers out of the EEA, the UK and Switzerland, Google says it complies with the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, and Google’s data protection terms set out further safeguards.

When you email us, your message comes to us in India so we can answer it. We look at Firebase and AdMob reports from India; they don’t name you.

Security

Information sent by the app to Firebase and AdMob travels encrypted over HTTPS. Google protects the information it holds for us with its own security measures. On your phone, the app keeps its data in private storage that other apps can’t read, protected by your phone’s own security. Access to our Firebase, AdMob and email accounts is limited to us. No method of storage or transfer is perfectly secure, but we work to protect what we handle.

Your rights

Everyone

Wherever you live, you can ask us what information we hold about you, ask us to correct or delete it, or ask any question about this policy. Email us at harshitkikani9081@gmail.com. We reply within two business days and finish within 30 days. There’s no charge.

The honest limit: we don’t know who you are

The app has no accounts, and nothing we receive carries your name, email or phone number. Your usage statistics and crash reports are filed under random identifiers that the app doesn’t show you, so when you email us, we can’t match the message to your records. That protects your privacy, but it also means we can’t pick out your data to show it to you or delete it.

What works in practice:

1. Turn off Settings > Privacy > Share usage and crash reports. Nothing more is sent from then on.
2. Reset or delete your advertising ID (Android) or keep tracking off (iPhone and iPad), and use “Privacy choices” where the app shows it.
3. Delete the app. Everything on your phone goes with it, and a fresh install starts with new identifiers that aren’t linked to the old ones.
4. What was already sent expires by itself: crash reports after 90 days, usage statistics after 14 months.
5. Email us anyway. We’ll answer your questions and delete our emails with you.

EEA, UK and Switzerland

Under the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection, you have the right to access your personal data, to have it corrected or erased, to restrict or object to how we use it (including objecting to uses based on legitimate interests), to data portability, and to withdraw consent at any time without affecting what was done before. The limit described above applies, and we’ll explain what we can and can’t do for each request.

You can also complain to a data protection authority, for example where you live or work:

• EEA: find your authority in the list of the European Data Protection Board’s members.
• United Kingdom: the Information Commissioner’s Office.
• Switzerland: the Federal Data Protection and Information Commissioner.

We’d be glad to try to sort things out first, so please write to us.

California

This section is our notice at collection and privacy policy for California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

What we collect, and where from. Since its release, the app has collected these categories of personal information, all of it from your device through the services described above, plus anything you tell us when you contact us:

If you write to us or call, we also have your email address or phone number and what you tell us. We use them only to answer you, and they’re stored in our Gmail account.

We don’t collect sensitive personal information as the law defines it. Retention for each category is in “How long we keep information”.

Selling and sharing. We don’t sell personal information for money. When ads are on, letting Google AdMob and its ad partners collect identifiers, network activity and approximate location may count as “selling” or “sharing” personal information for cross-context behavioral advertising under California law. We don’t knowingly sell or share the personal information of anyone under 16.

Your rights. You have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of its sale or sharing; and not to be treated differently for using any of these rights. We don’t use sensitive personal information, so there’s nothing to limit.

How to opt out of sale or sharing. Open Settings > Privacy choices in the app and opt out in Google’s form. Keeping tracking off on iPhone and iPad, or deleting your advertising ID on Android, also limits how ads use your device’s ID, but it isn’t a full opt-out on its own; use Privacy choices for that. If you email us, we’ll walk you through these steps, since we have no way to apply an opt-out to your phone from our side. This website doesn’t sell or share personal information, so it has nothing for a Global Privacy Control signal to switch off.

How to make a request. Email harshitkikani9081@gmail.com or call +91 95122 03345. We’ll reply within two business days and answer in full within 45 calendar days, or tell you if we need up to 45 more. Because we hold no names or accounts, we’ll ask only for what we need to find any records, and we’ll explain the limit described in “The honest limit” above. You can use an authorized agent; we may ask for proof that you gave them permission.

Other US states

Residents of states with their own privacy laws, such as Colorado, Connecticut, Oregon, Texas and Virginia, may have rights to confirm whether we process their personal data, to access, correct and delete it, to get a portable copy, and to opt out of targeted advertising, the sale of personal data, and certain profiling. We honor these requests in the same way as California requests, and the same opt-outs work.

If we decline your request, you can appeal by replying to our answer with “Appeal” in the subject line. We’ll respond within 45 days and explain our decision. If you’re still not satisfied, you can contact your state’s Attorney General.

India

Under India’s Digital Personal Data Protection Act, 2023, and its rules as they come into force, you can ask for a summary of the personal data we process and who we share it with, ask us to correct, complete, update or erase it, have your grievances addressed, and nominate someone to act for you. Please bring any complaint to our Grievance Officer first. If you aren’t satisfied with our answer, you can then complain to the Data Protection Board of India.

Grievance Officer

In line with India’s Information Technology Act, 2000 and its rules, our Grievance Officer is:

• Name: KHKikani
• Email: harshitkikani9081@gmail.com
• Phone: +91 95122 03345

We acknowledge every complaint within two business days and resolve it within 30 days.

Changes to this policy

If the app or the law changes, we’ll update this policy and its effective date. If a change matters to how your information is used, we’ll say so on this page and in the app’s release notes before it takes effect, and where the law requires your consent, we’ll ask for it.

Contact us

KHKikani, India

• Email: harshitkikani9081@gmail.com
• Phone: +91 95122 03345

You can also read our Terms of Use, get help on the Support page, or see Your data and how to delete it.