Privacy Policy

Effective date: 22 September 2026.

1. Who we are

The data controller is KOHA-TECH Sp. z o.o. (Koha-Tech spółka z ograniczoną odpowiedzialnością), Nowy Świat 33/13, 00-029 Warszawa, Poland. KRS 0001183713 · NIP 5253054129 · REGON 542256381 · share capital PLN 5,000.

Trade name for this product: Buffs & Crafts. Contact: [email protected].

2. What this policy covers

This policy covers the Buffs & Crafts game, including the installed web app at play.buffsandcrafts.com, its privately shared Android development build, and this website. The iOS version is available on the App Store. If you join the waiting list on buffsandcrafts.com, we store the email you submit, the country Cloudflare reports for that request, and the browser language, so we can email you about the App Store launch and game updates in a matching game language, and then nominate you for early access (see below). Installing the web app at play.buffsandcrafts.com does not require your email. The website and web app may measure visits, PWA installs, and retention after you accept analytics cookies (see Cookies). Those events are recorded by Tracuto after the hosted script loads. The Android and desktop development builds do not include in-game analytics or crash reporting.

3. The game — data we do not collect

The current game stores progress on your device only: your hero’s nickname, currencies, equipment, inventory, buffs, builds, settings, and local save files. In the installed web app that uses IndexedDB on play.buffsandcrafts.com. That data is used to resume play. It is not sent to KOHA-TECH as a cloud save.

The game does not require an account. Your hero’s nickname is a local game setting, not an account registration. Native Android and desktop development builds do not include analytics, live advertising, crash-reporting, multiplayer, or application-managed cloud save. The web app does not request camera, microphone, contacts, photos, or location. It does not use an advertising identifier or App Tracking Transparency, because it does not track across apps.

Deleting the app’s local data removes the local adventure and its in-game backups. The Android development build does not enable Android system backup for game data. On iOS, device backups (iCloud/Finder) may include those files according to your Apple ID backup settings. That is Apple’s backup system, not a KOHA-TECH cloud service.

Gameplay progress is not uploaded as a studio cloud save. If you accept analytics on the website or web app, Tracuto records page, install, and session events so we can measure use. Contact emails and technical requests made by this website are described separately below.

4. Payments and ads

On the web shop, optional purchases use Stripe Checkout and the Stripe customer portal. Stripe processes your payment card and email under Stripe’s terms and privacy policy. We receive what is needed to deliver and restore Artisan's Blessing (for example a checkout session or subscription identifier and the email on the receipt). Consumable ore and gem packs are delivered to the device that completed checkout and are not restored later.

Live product identifiers are buffs.artisan.monthly, buffs.artisan.yearly, buffs.ore_pack, and buffs.gem_pack. Artisan's Blessing does not change forge odds. Desktop and Android development builds may still include clearly labeled simulated shop and rewarded-ad flows that do not process a payment. The iOS App Store version will use Apple In-App Purchase when that build ships; it is not used in the web shop.

Rewarded ads are not offered in the web shop. Android and iOS builds may show Google AdMob Double Loot after a victory if you opt in.

5. This website

We do not use advertising cookies or sell personal data. Analytics loads only after you choose Accept analytics.

6. Cookies

We store one essential preference in your browser (buffsAndCrafts.cookieConsent) so we remember whether analytics is allowed. If you join the waiting list, this browser also stores buffsAndCrafts.waitlistJoined so we can show the congratulations message. Those records are not used to identify you or to send analytics.

If you accept analytics, this site and the web app load the Tracuto script from sdk.tracuto.com. Tracuto (KOHA-TECH) then records page views, clicks, and the events we send after consent (for example waiting-list joins, PWA install, and purchases). You can refuse analytics and still use the site and the game.

7. Sharing

We use hosting infrastructure to serve this site and the web game. Waiting-list emails, country, and language are stored in KOHA-TECH’s Postgres database (schema buffsandcrafts) in the European Economic Area. Cloudflare provides the country code on the join request. Stripe processes web shop payments. Optional analytics is processed by Tracuto (KOHA-TECH) after consent. We may disclose information if required by law. Apple may process App Store, TestFlight, and (if enabled) In-App Purchase data for the iOS build. Google may process font requests if you load this site with Google Fonts enabled, and Tracuto may process analytics requests if you accept analytics.

8. Retention and your rights

Support emails are kept as long as needed to resolve the request and meet legal record-keeping. Waiting-list emails, country, language, and join requests are kept until you ask us to delete them, or until twelve months after the public store launch when the waitlist purpose ends, whichever comes first. Server logs are rotated on a short operational schedule. Game saves live on your device until you delete them. Analytics events are kept for website measurement and then deleted or aggregated on an operational schedule. You can withdraw analytics consent with the buttons above, or by clearing this site’s data in your browser. To remove a waiting-list email, write to [email protected].

If GDPR applies, you may request access, correction, deletion, restriction, or objection, and you may lodge a complaint with the President of the Polish Personal Data Protection Office (UODO). Email [email protected].

9. Children

Buffs & Crafts is a storybook fantasy game. The App Store age rating is 12+ because of fantasy combat with weapons. The waiting list is for people aged 16 or older, or a parent or guardian joining on a child’s behalf. We do not knowingly collect a child’s email. The game asks you to choose a hero’s nickname, which stays on your device; playing does not require your real name, email address, or an account.

10. International transfers

KOHA-TECH is established in Poland (EEA). Hosting, font, payment, or analytics providers may process technical or payment data outside the EEA under their own terms. Gameplay progress is not uploaded as a studio cloud save. Stripe checkout and restore requests send the store SKU or receipt email to our billing API so the purchase can be completed. Analytics events sent after consent do not include your hero name, inventory, save file, or waiting-list email. Waiting-list records stay on our server in the EEA.

11. Changes

We will post updates on this URL and change the effective date. Material changes that affect App Store privacy answers will be made before a binary that collects more data is released.

Related: Terms of Service · EULA · Support