1. Controller (Art. 4 (7) GDPR)

Cosmic Drift Game Studio
Marc Frost
Slevogtstr. 10
04159 Leipzig
Germany
Privacy contact: hello@kumiko.rocks

2. What we process

• Account data: e-mail address, display name and a hashed password once you create an account.
• Financing data: loan and amortization figures you enter (loan amount, interest rate, term, extra payments). They stay tied to your account and are not shared with third parties for marketing or advertising.
• Session data: a strictly necessary cookie keeps you signed in.

3. Purpose and legal basis

Processing is for providing the service (GDPR Art. 6(1)(b)) and for legitimate interests in secure operation (Art. 6(1)(f)).

4. Retention and security

• Financing data: while your account is active; deleted with your account within 30 days unless statutory retention applies. After deletion, copies in backups remain for up to 30 days, and in the delete-locked backup copy for up to about two months longer.
• Server logs: deleted after 31 days; IP addresses are truncated before storage (IPv4 to /24, IPv6 to /64).
• Support email correspondence: until handled, at most 24 months.

Financing data is stored in databases on servers in Germany. Passwords are stored hashed only; production data access is limited to operations.

5. Cookies

We use only a strictly necessary auth-session cookie (Art. 6(1)(f)). No tracking, no analytics, no cookie banner required.

6. Your rights in the service

CashColt provides data export and account deletion directly from account settings.

The German version of this policy (/legal/datenschutz) is the legally binding one.

Contact form and problem reports

You can use the contact form on cashcolt.kumiko.rocks to ask a question, get in touch or report a bug. For this we process the kind of request, your name, your e-mail address and your message, as well as the language and the page you write from. If the form asks for a phone number, we process that as well.

Signed-in users can write to us in CashColt via "Report a problem". In that case we also store the attached files and the technical context of the report: your user account, the name and plan of your account, the page, the app version, the name and version of your browser and the language.

We process this data to handle and answer your request. The legal basis is Art. 6(1)(b) GDPR where your request concerns a contract with us or steps towards one, and otherwise our legitimate interest in answering requests and fixing bugs (Art. 6(1)(f) GDPR).

Your request is stored in the application. Our administrators receive a notification by e-mail that contains only the kind of request and a link, none of your data. You receive an acknowledgement at your e-mail address, which after a problem report includes a copy of your message. We answer you by e-mail. All e-mails are sent through the e-mail provider named below under "Sub-processors".

We delete requests, our replies and attached files automatically 365 days after they were received or the reply was sent. If you delete your account, we delete your reports with it.

To stop the form from being used in bulk, your browser solves a small computing task before sending. This sets no cookie and stores no data about you. The form accepts at most 5 messages per IP address in 10 minutes and at most 3 per e-mail address in 24 hours. For this the application keeps the IP address and a counter in a cache. Instead of the e-mail address it stores only a hash formed with a secret key. Both entries expire automatically, after 20 minutes and 48 hours at the latest.

Sub-processors

We use the following sub-processors per GDPR Art. 28:

| Provider | Purpose | Location | Data processed | |---|---|---|---| | Hetzner Online GmbH | App hosting, database, server logs, DNS | Germany (Nuremberg) | IP address, user-agent, request time, application and account data | | Meilisearch (on Hetzner) | Full-text search of application data (where enabled) | Germany | Indexed text and metadata | | Brevo (Sendinblue GmbH / Brevo SAS) | Delivery logs of emails sent until 1 November 2026, until deleted | EU/France | Email address, name, delivery status | | Scaleway SAS (Transactional Email) | Transactional email (e.g. password reset, when configured) | France (Paris, EU) | Sender and recipient address, subject, submitting IP, delivery status; content only until delivery | | Stripe Payments Europe, Ltd. | Payment processing (when enabled for the app) | EU (Ireland) | Payment status, billing data | | Scaleway SAS | Offsite backup mirror (object storage); file storage for customer apps (when provisioned via Kumiko Studio) | France (Paris, EU) | Encrypted backup copies; files uploaded to those apps |

We have DPAs with Hetzner and configured EU providers per GDPR Art. 28.

Third-country transfers

Transfers to third countries occur only where necessary for operation (e.g. via configured payment or email providers) and are safeguarded by DPAs and Standard Contractual Clauses (SCC) or equivalent guarantees. Core application data and search indexes are processed at Hetzner in Germany.

Details: Sub-processor list

Your Rights

Per Art. 15–22 GDPR. Requests to hello@kumiko.rocks.

Right to Complain

You may complain to your local supervisory authority or to the supervisory authority responsible for us: Saxon Data Protection and Transparency Commissioner (SDTB), Maternistraße 17, 01067 Dresden, Germany, post@sdtb.sachsen.de, https://www.datenschutz.sachsen.de/.