Nothing is sent anywhere
Pogled requires nothing of you. There is no registration step, no profile, no advertising slot, no measurement library along for the ride, and no list that anybody is added to. Five statements, and statements are easy to make. The sixth can be verified without trusting anyone: the published package declares no internet permission. An Android app receives only the permissions written into its package, so one that never asked for the network does not have it, whatever its code might prefer. The declaration is printed on the store page, there to be read before installing.
Your play is of course remembered — the grids you have finished, your best time on each, the half-shaded board you walked away from. Each app on Android is handed a private area of storage, and all of that sits inside Pogled's. Nothing is copied to any machine at this end. Which has a blunt consequence: your play is in nobody's custody but yours, which means no repository here to be broken into, nothing available for sale, and nothing we could surrender to a demand even if one arrived.
Twelve cells follow. Together they address what the General Data Protection Regulation expects a notice of this sort to address, and the twelfth says where to write should you want to dispute any of them.
Whose name stands behind this
ControllerAUTO - RANKO d.o.o.
Formdruštvo s ograničenom odgovornošću, registered in Croatia
Signs for itRanko Milošević
Registered atGornji Draganec 185, 43245 Gornji Draganec, Croatia
This pagevid@auto-ranko.store
AppPogled — com.vidoset.pogled
Under Article 4(7) the title controller falls to whoever determines the purposes a processing operation serves together with the means of carrying it out. That is the reason a company name heads a page of this kind instead of appearing somewhere in its closing lines. Shorn of ceremony it amounts to two commitments: nothing written below is untrue, and a named individual answers for whatever part of it turns out to be.
No data protection officer has been appointed, and that is a finding worth showing rather than a blank worth noticing. Appointment is obligatory in three circumstances only — a public authority; large-scale systematic monitoring as the core activity; large-scale processing of the special categories. A small company shipping a single offline puzzle is nowhere within reach of any of the three. To name somebody regardless would advertise a safeguard with nothing to safeguard.
The complete list of what is stored
A puzzle game must remember something, or every evening would restart at the first grid. This is the whole of it:
- Which grids you have solved, pack by pack, so the level screen can show where you have reached.
- Your best time on each solved grid, so a quicker run can be recognised as one.
- The grid you are part-way through — which cells you have shaded, which you have marked as staying white, the undo steps still in hand — so putting the phone down does not cost you the reasoning you had done.
- Hints remaining from the allowance.
- Your settings — language, sound, and the few switches on the settings screen.
Read that list now for its silences. At no point is a name asked for. Nothing that functions as an address is recorded. Android's advertising identifier is never consulted. Device characteristics are not combined into anything that could serve as a fingerprint. And Pogled issues itself no installation number — the omission on which all the others rest, since without one there is no method, here or anywhere, of distinguishing your copy from somebody else's. Enclosing all of it, the operating system keeps that storage shut to every other app on the device.
Remove the app and all five items disappear with it. Should you want the game but not the record, the settings screen carries a reset, and Android's own "clear data" achieves the same thing.
Why no lawful basis is quoted
The usual rhythm of such a document is two beats at a time — a thing collected, then the Article 6 basis licensing it, then the next thing. Here the second beat never lands. Anyone who notices that absence running the length of the page should have the reasoning put in front of them rather than left to guess.
Any lawful basis is a response to one challenge — produce your title to this. The challenge needs a holder and a thing held, and here there is neither. What cell 03 lists sits on hardware belonging to you and beyond reach from this end, and it identifies nobody: subtract identifiers that were never recorded and the remainder is a note of how one handset fared against some shaded grids. The Regulation requires two things standing together, personal data and a controller processing it. Take away the first and nothing is left to support the second.
An argument endures only as long as its premise. Add a login, put an advert in, link a measurement library, open a shop — any one of those ends the premise within the day — whereupon this text must be rewritten and published in the release that brings the change, every new item accompanied by the basis permitting it. There is a comment at the very bottom of this document holding the working notes for that.
Nor does a cookie banner appear, for closely neighbouring reasons. What those rules catch is storage on, or retrieval from, equipment the user owns, going past what the requested service actually requires; and and delivery almost always comes by one of three routes: a browser view built into the app, a measuring pixel, or a tag placed by an outside party. Pogled holds none of the three, and if one were smuggled in it would find no connection to report over — leaving the Croatian implementation of those rules with no subject matter here.
One requested, the rest declined
Requested
Vibration, for the small knock as a cell is shaded, and only while that switch stays on. Android asks you nothing before granting it, and rightly so — a vibration motor has no information to give up about its owner.
Declined
The network above all; and in consequence of that one refusal, camera, microphone, positioning, contacts, storage outside this app's folder, telephony state, notifications.
Everything else here leans on that second box. Nothing can be transmitted without a way out, and no way out exists; so where your data ends up stops being a matter of our word and becomes an attribute of the build, which anyone sufficiently curious can verify for themselves.
Any permission dialog that takes you by surprise should be refused; then tell us which build it came from, at vid@auto-ranko.store. Only two things could be behind it — either the words here no longer match what was shipped, or what you installed came from someone other than us. Either is worth running to ground immediately, if only for the next person who installs it.
Google Play is its own transaction
The cells above all describe Pogled in operation on your phone. How it got there is a different affair entirely, and one that closed before any of this began — between you and Google. Google logs the download, every later update and any rating you leave, filing all of it against whichever account happened to be signed in, on the terms it writes for its own marketplace. That record is invisible from here and not ours to alter.
What reaches this end is the Play Console's summary, and it speaks only in aggregates: a tally of installs, an approximate distribution by country, faults sorted into groups, a single average rating. Nowhere does it resolve to an individual. The material behind your Google account — the billing address, the stored payment method, the devices it has signed into — never crosses over, and Google supplies its own controls over that material, operated from inside the account. A question about any of it has to be taken there.
One word of warning about the listing itself: a review is public from the instant it is posted, under whichever name the account displays, and stays visible to every later visitor.
There is nobody downstream
Work that nobody is performing cannot be subcontracted. Name the usual parties and each is missing: no server storing anything for the game, no analytics property watching it, no crash reporter collecting from it, no advertising exchange plugged into it, no mailing platform holding addresses on its behalf, no payment agent of any description. None of these was assessed and declined; the job they exist to do simply never arose. Article 13(1)(e) calls for the categories of recipient to be listed, and listed truthfully there is nothing to put.
Cell 06 is placed before this one on purpose, to mark where responsibility at this end stops rather than to bury the point: it describes an exchange taking place on Google's infrastructure, governed by Google's own contract with you, and already concluded by the time the game is first launched.
Nothing crosses a frontier
Chapter V of the Regulation governs sending personal data outside the European Economic Area, and it has given rise to a considerable apparatus: adequacy decisions naming countries judged to protect data properly, the standard contractual clauses, binding corporate rules, and a short list of derogations in Article 49 for the cases none of those cover.
Every one of those instruments is constructed around a shipment. Here there is no shipment. A solving time arrived at on your handset was written to that handset's own storage, and has never been duplicated to a second place — not to a server in Croatia, not to one in Ireland, and not to one anywhere else. The question that Chapter V exists to answer is therefore never reached.
This cell is separated from cell 07 rather than folded into it because the two are often run together and should not be. One says that nobody else receives your data; the other says that it does not travel. Both happen to be true here for the same underlying reason, but they are different promises, and if either ever stops holding it will stop holding on its own.
Exactly as long as you allow
Clauses of this kind usually quote a number of months, because the keeping is being done by somebody the reader has no authority over. In this case the keeping is being done by you, which makes a figure meaningless and a condition the only truthful form of the answer: it survives exactly as long as you choose to let it, because the reset and a plain uninstall each finish it the second either is used.
No nightly process copies it anywhere. No archive preserves a previous state. There is no arrangement at this end through which some fragment could survive the decision you made. Nor does the passage of time wear it away on its own: a best time left untouched for three years is still a best time, on your phone, read by you and by nobody else.
What a parent would look for
Pogled carries a general-audience rating, and darkening squares until a column of numbers finally agrees is an entirely innocuous way for a child to pass an hour. Four questions tend to make up a parent's check. Does it advertise at children? Can a stray finger buy something? Is there any way in for a stranger? Does it show things other users wrote? The answer is no to each, and not because they were disabled — none of the four was ever built.
Article 8 would ordinarily be relevant here too, fixing as it does the age below which a child's consent to an online service requires a parent standing behind it. It finds nothing to grip: consent is requested of nobody in this game, at any age. Croatia sets that age at 16, the highest the Regulation allows a member state to choose. The figure is written down now, while it changes nothing, so that it is already on the page should advertising ever bring it to life.
Eight rights, and what each actually produces
None of the eight is cut down on this page. What differs is where they are exercised: for nearly all of them the handset in front of you has already settled the matter, and no letter need travel in either direction. Pushing a request through a formal channel whose single possible outcome is a note saying we hold no file on you would be staging rather than safeguarding. The table below skips to the outcome.
Access · 15A short reply confirming there is nothing to disclose. The level screen already shows everything the game keeps, and opening it needs nobody's permission.
Rectification · 16Wrongness is a property of records, and none are kept. If a stored time understates you, solve the grid faster.
Erasure · 17Immediate and yours alone — the reset, or removing the app. No request arrives here, so none of yours can be refused, left in a queue, or returned on the final day of the month.
Restriction · 18It suspends an operation while something is disputed. No operation on your data is running, so the suspension would apply to nothing.
Portability · 20Its subject is material a person surrendered to a controller, so that they may take it elsewhere. You surrendered none, and the game's record is a file already on equipment you own.
Objection · 21Something has to be happening before it can be objected to. The limb that cannot be refused concerns direct marketing, and nothing of that kind goes out from here.
Consent · 7(3)Agreement is requested nowhere, and nothing in the game operates on the strength of having received it. Withdrawal presupposes a live permission; there is none.
Automated decisions · 22Deciding whether a number is satisfied means counting cells along four lines. The verdict concerns a grid, never the person looking at it.
There is nothing to pay, nothing to fill in, and no identity to establish. The point of an identity check is that one person's records should not be handed to somebody else; with no records on this side it protects nothing at all, and asking you for papers in order to confirm that we hold none of yours would be faintly ridiculous.
If you want to argue with any of it
Everything goes to vid@auto-ranko.store. One address, read by one person, with nothing in between. Send a claim under any of the eight rights, an objection to something written here, a report of a permission dialog that cell 05 leaves unexplained — or just a question, if you want to know how a part of it works.
Slobodno pišite na hrvatskom — ista adresa, i odgovor stiže na hrvatskom.
Croatia gives effect to the General Data Protection Regulation through the Zakon o provedbi Opće uredbe o zaštiti podataka, and supervision belongs to the Agencija za zaštitu osobnih podataka — AZOP. Its address is Selska cesta 136, 10000 Zagreb, and azop.hr is the practical way in. Zagreb is only one of three doors Article 77 leaves open, however: you may lodge it with the authority for wherever you normally reside, or wherever you are employed, or wherever you think the infringement took place, and no explanation is owed to anyone for the choice. Nothing on this page has the power to narrow those three, and a clause claiming otherwise would be unenforceable. Writing to us before doing so is merely a suggestion, carrying no obligation whatever: a matter already lodged with AZOP and a letter in this inbox can proceed together without the slightest difficulty.
A version number sits under the title, moving on every edit made above it. When those edits go out is governed by one rule that does not flex. Should a rewrite be prompted by the software itself doing something new — holding on to a fresh item, letting a fresh party in, pushing traffic across a border for the first time, picking up an extra purpose — then the new text goes out in the release that introduces it, never a release later. No behaviour reaches phones while its explanation is still a draft. One consequence is useful: glance at the version and you know whether these sentences were composed for the build you have. We keep what the current version replaced, and will send a copy if you want one.