Privacy Policy (Clock Forest)

1. Scope and Our Approach

This Privacy Policy explains how Nagilit Labs ("we," "us," or "our") handles information in Clock Forest (the "App"), a learning app directed to children under 13.

The App is designed to comply with the U.S. Children's Online Privacy Protection Act (COPPA), Apple's Kids Category requirements, and the Google Play Families policy. It does not require an account, and children do not need to provide personal information to use it.

For the processing described in this Policy, Nagilit Labs acts as the data controller.

2. What the App Does Not Collect

• No accounts or sign-ins. There is nothing to register for, and no password or contact detail is ever requested.
• No names typed by children. Save slots are labelled automatically by the App (for example, "Player 1"); a child never enters a name.
• No email addresses, phone numbers, or postal addresses.
• No location data, photos, contacts, camera, or microphone access. The App requests no such device permissions.
• No advertising identifiers. The Android build explicitly removes the advertising ID permission, and the App does not read the iOS advertising identifier.
• No advertising SDKs, ad networks, or ad tracking of any kind.
• No social features, user-to-user communication, or user-generated content.
• No sale or sharing of personal information, to anyone, ever.

3. Information Processed by the App

Stored on the device. The App stores game progress, selected character, collected items and coins, learning records, audio settings, and a local record of unlocked content on the device. This information is not uploaded to us.

Processed by service providers. The App processes limited technical and purchase information through the providers below. Firebase Analytics is active only in production releases from the app stores. Firebase Crashlytics and RevenueCat are also active in beta releases distributed through TestFlight and Google Play internal testing.

• Firebase Analytics (production releases): app-interaction events, such as screen views and gameplay or purchase-flow events, used to understand and improve App quality.
• Firebase Crashlytics (production and beta releases): crash, error, and diagnostic information used to investigate and fix reliability issues.
• RevenueCat (production and beta releases): in-app purchase product, transaction or receipt, and entitlement information used to process, verify, and restore the one-time purchase.

Pseudonymous identifiers. Firebase Analytics uses an app-instance identifier and RevenueCat uses an anonymous app-user identifier. These values are generated on the device or by the provider and are not linked to a name, email address, or account. The App does not set any user identifier of its own. Under COPPA, we rely on these identifiers solely to support the internal operations of the App — maintaining and analyzing how it functions, diagnosing errors, and verifying and restoring purchases — and never for behavioral advertising, cross-app tracking, or profiling of children.

4. How We Use Information and Legal Bases

• Provide game functionality and keep progress and settings available on the device
• Verify, restore, and support the one-time in-app purchase
• Maintain security, diagnose crashes and errors, and improve App reliability and quality
• Respond to privacy questions and requests from parents or guardians

Where the GDPR or UK GDPR applies, our primary legal bases under Article 6 are:

• Legitimate interests: App stability, security monitoring, and fraud prevention
• Contract necessity: Purchase verification and restoration support
• Legal obligations: Accounting, tax, and legal compliance where applicable

We adhere to purpose limitation and data minimization, and we do not process data beyond what is necessary for these purposes. We do not profile children.

5. Where Data Lives and International Transfers

We operate from Japan. Game progress and learning records never leave the device, so no child's game data is stored on our servers in Japan, the United States, or anywhere else. The only information that reaches us does so through the service providers listed in section 8, and it is limited to anonymous diagnostics and purchase records that contain no personal information.

Our providers' infrastructure may process that information outside your country, including in the United States. Where required, we rely on Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms. Wherever we operate from, we design the App to comply with the laws that apply to it, including COPPA.

6. Children's Privacy and Parents

The App is directed to children under 13 and is designed so that children do not need to provide personal information directly. Purchases and links that leave the App sit behind a parent gate, so a child cannot reach them alone.

Parents and legal guardians may ask about our data practices and request deletion. Because the App does not use accounts, most game data exists only on the device and is under your direct control:

• From the save-slot selection screen, a parent or guardian can delete any individual save slot. Deleting a slot removes that slot's progress and learning records from the device.
• Deleting the App removes all local game data.

Without an account, we may not be able to find provider data from a name or email alone. Contact us to request deletion. We will check what can be identified and deleted, and explain any limits.

7. Your Choices

Uninstalling the App stops future analytics and crash reports, but does not delete data already held by service providers.

8. Service Providers and International Processing

We use Google LLC (Firebase Analytics and Crashlytics), RevenueCat, Inc. (purchase management), and Apple Inc. or Google LLC (store payment processing).

We require these providers by contract to protect this information to a standard at least equivalent to this Policy, to process it only on our instructions and for the purposes described above, and not to use it for their own advertising or for profiling children. Their own policies are available here:

• Firebase Privacy and Security
• RevenueCat Privacy Policy
• Apple Privacy Policy
• Google Privacy Policy

9. Retention and Security

Local game data remains on the device until it is deleted through the App, through device settings, or by uninstalling the App.

Information held by our service providers is retained only as long as needed for the purposes described in this Policy:

• Analytics event-level data is retained for up to 14 months.
• Crash data is retained according to periods defined by the relevant service provider.
• Purchase and entitlement records are retained for as long as needed to verify and restore purchases and to meet accounting and tax obligations.
• Aggregated anonymous statistics may be retained longer for long-term product improvement and quality analysis.

We use reasonable safeguards appropriate to the App's operation. No transmission or storage system can be guaranteed completely secure.

10. U.S. Privacy Rights

Depending on applicable law, U.S. residents may have rights to know, access, delete, correct, or obtain information about personal information processed about them. We do not sell or share personal information, and we do not use it for cross-context behavioral advertising.

Parents or guardians may submit a request using the contact details below. We may request information reasonably necessary to verify and process the request.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Updates take effect when posted on this page. For material changes, we may provide notice through App update information.

12. Contact and Data Requests

For questions, access requests, or deletion requests, visit our Data Access and Deletion Requests page or contact us directly.

Operator: Nagilit Labs
Postal address: 6F, remix Nihonbashi, 2-16-4 Nihonbashi, Chuo-ku, Tokyo 103-0027, Japan
Phone: +81 80-2013-5721
Email: nagilit.dev@gmail.com