Privacy Policy

Krool World Last updated: November 10, 2026

This privacy policy describes how Krool World (“we”, “us”, “our”) collects, uses, and shares information when you use our game Dive Dude 2 (the “Game”) on iOS or the web.

By using the Game you agree to this policy. If you do not agree, please uninstall the Game.

1. No Account Required

The Game has no login or account system. You do not create an account, and we do not ask for or receive your email address, password, phone number, or any “Sign in with Apple” / social identity. You can play the entire Game without providing any personal information.

2. Information We Collect

2.1 Information you provide

Display name — You may choose a name for your diver. Your chosen name is stored on your device and registered with our online name service so it can appear on leaderboards and in multiplayer. Our server runs an automatic profanity filter on names: a filtered name is refused by the name registry and the leaderboards and replaced with a placeholder in multiplayer lobbies. A custom name you type is reserved for your install (see Install ID below) until you reserve a different one or ask us to remove it. Auto-generated names are not registered.
Bottle messages — The Game includes an optional “message in a bottle” feature. If you choose to write and send a short message, it is stored in a shared global pool and may be shown at random to other players. It is signed with your display name, avatar, and level as they were when you sent it. A message the profanity filter flags is discarded. The pool keeps the newest 2,000 messages, and a player who draws a message can discard it for everyone. Do not include personal information in a bottle message; treat anything you submit as public.

2.2 Information collected automatically

Scores and run statistics — When you post a score, your run result and associated statistics are sent to our leaderboard service and stored with your display name, selected diver, avatar, run duration, and cause of death. This includes Daily Dive results, which are ranked on a shared daily board. To deter cheating, our server records when a run starts and validates the elapsed time when you submit; no other personal data is used for this.
Multiplayer session data — If you create or join a multiplayer lobby, our server temporarily stores match data for the duration of the session: an opaque, server-generated, per-room player identifier (a new one each time you join a room, so it cannot be used to track you across rooms), your selected diver, avatar, and reaction emojis, your jump inputs, and your score. This data is transient and tied to the match.
IP address. When your device contacts our servers, your IP address is processed to route requests and apply rate limits. Our server does not store the address itself. It stores a salted SHA-256 hash of it, which we cannot turn back into the address, to rate-limit score submissions, run starts, and lobby creation: in a rate-limit log, with each run-start token, with each Daily Dive entry, and with each all-time leaderboard entry (retention for each is in section 5). Name checks, bottle messages, and lobby joins are rate-limited with the address held in server memory for about a minute and not written to storage. We do not use any of this to build a profile of you.
Install ID. The first time the Game checks or reserves a custom name, or sends or draws a bottle message, it creates a random ID and saves it on your device. It is not derived from your device or identity. Our server stores it next to a custom name you reserve, so only you can keep that name, and next to bottle messages you send, so you are not handed your own message.

2.3 Information stored only on your device

Game progress and settings — Your progress, coin balance, unlocked divers and cosmetics, achievements, equipped items, multiple local profiles, and preferences are saved locally on your device using local storage. This data does not leave your device unless you post a score or use an online feature described above.
Haptics — On supported devices the Game triggers vibration feedback. This involves no data collection.

2.4 Information we do NOT collect

We do not collect your precise location, contacts, photos, microphone, or camera data.
We do not use advertising SDKs or serve ads. No advertising identifiers (IDFA/GAID) are collected.
The iOS app does not run analytics or tracking SDKs. On the web, and only if you choose Allow on the consent banner, the Game uses Google Analytics to collect anonymous usage data (gameplay events, device and browser type, and an approximate location derived from your IP address). Its advertising features are disabled, and you can change your choice at any time in Settings.
The Game has no in-app purchases and no real-money transactions. In-game coins are earned by playing and have no monetary value.
The Game is not directed at children under 13, and we do not knowingly collect personal information from children.

3. How We Use Information

We use collected information to:

Display and rank scores on global and Daily Dive leaderboards
Keep display names consistent and unique across players
Operate the optional message-in-a-bottle feature
Host real-time multiplayer matches
Route requests, apply rate limits, and protect our services from abuse

We do not sell your personal information, and we do not use it for advertising.

We share information only with the following service providers, and only as necessary to operate the Game:

Service	Purpose	Data shared
Cloudflare (Workers, D1, Durable Objects)	Host the leaderboard, name registry, bottle-message pool, and multiplayer lobbies	Display name, scores and run stats, bottle messages, install ID, salted IP hash, transient match data, connection data
Google Analytics (web only, with your consent)	Usage measurement	Anonymous gameplay events and standard session data

Your display name, scores, and any bottle message you send are, by design, visible to other players. We do not share data with data brokers or advertising platforms. We may disclose information if required by law, subpoena, or court order. Cloudflare’s privacy policy applies to their processing: https://www.cloudflare.com/privacypolicy/.

5. Data Retention

Local game data is retained on your device until you clear local storage or uninstall the Game.
Reserved display names, with the install ID that holds them, are retained until you reserve a different name or ask us to remove yours.
All-time leaderboard entries are retained indefinitely. The salted IP hash stored with an entry is erased once the entry is 30 days old.
Daily Dive entries, with their salted IP hash, are deleted after about 8 days.
Rate-limit records (salted IP hash and time) are removed once about 2 minutes old. Run-start tokens are removed after they expire at 4 hours.
Bottle messages, with the sender’s install ID, remain in the shared pool until a player discards them, we remove them, or they fall outside the newest 2,000.
These removals run as a periodic cleanup, so a record can outlive its limit by a short time.
Multiplayer match data is transient and is discarded after the match ends.

6. Your Rights and Choices

Local data — To delete progress, settings, and profiles stored on your device, clear the app’s local storage or uninstall the Game.
Server data — To request deletion of your display name, leaderboard entries, or a bottle message you submitted, contact us at the email below. We will respond within 30 days.

Depending on your jurisdiction (e.g. GDPR, CCPA), you may have rights to access, correct, delete, or export your data. We do not sell personal information. Contact us to exercise any applicable right.

7. Data Security

We protect data in transit with HTTPS encryption and apply access controls on our infrastructure. The leaderboard uses a server-issued run-token model rather than any secret stored in the app. No system is 100% secure, and we cannot guarantee absolute security.

8. User-Generated Content

Display names and bottle messages are user-generated content visible to other players. Our server applies an automatic profanity filter to both. The filter is automatic and will miss things. We reserve the right to remove or reset names and messages that are offensive, misleading, or impersonate others. To report content, contact us at the email below.

9. Changes to This Policy

We may update this policy from time to time. We will post the updated policy on this page and update the “Last updated” date.

10. Contact Us

Krool World Email: kroolworld@proton.me

Home