Privacy Policy
Last updated: October 2026
Kolir is a daily photo game: one colour a day, found and photographed live. This policy explains what the app collects to make that work, why, who else is involved, and how to delete all of it.
What we collect
Your account. When you sign in with Google or Apple, we receive your email address and the name on that account, and a sign-in identifier from Firebase Authentication. If you use Apple's "Hide My Email", we only ever see the relay address.
Your profile. Your nickname, display name, time zone (so the colour changes at your midnight), interface language, and whether your profile is private.
Your hunts. Each photo you submit, the time it was taken, and what we measure from it: how closely it matches the day's colour, its representative colour, and how light or dark its corners are (so the app can draw readable controls on top). We also store a fingerprint (a SHA-256 hash) of each photo to stop the same file being submitted twice. Your streak, XP and history are derived from these.
What you do with other people's hunts. Your likes, the accounts you block, and the photos you report along with the reason you chose.
Your device, for reminders. If you turn on reminders, a push token for your device, its platform (iOS or Android) and the app version, plus the reminder times you pick.
What we don't collect
- No location. The app doesn't ask for your location and doesn't attach location data to the photos it uploads.
- No camera feed. While the camera is open, the app reads the colour in frame on your phone. Those readings never leave the device — only the photo you choose to take is uploaded.
- No photo library access. The app can save the photos you take to your camera roll (if you allow it), but it never reads your library.
- No advertising trackers, and we don't sell your data.
How it's used
To run the game: verify your photos, keep your streak, show your hunts in the feed (unless you hide them or make your profile private), send the reminders you asked for, and keep the community safe — reports are reviewed by a person, and photos reported by several people are blurred for others until they choose to view them.
Who else is involved
- Google Firebase handles sign-in.
- Google and Apple when you sign in with them.
- Expo delivers push notifications to your device.
- Hetzner hosts our servers and stores your photos.
Each processes data only to provide its service to us.
Who can see what
Your nickname, display name, streak, level and verified hunts are visible to other players, unless your profile is private — then your hunts stay out of the feed and nobody else can open your profile. You can also hide any single photo from the feed. Your email, time zone and settings are never shown to anyone.
Keeping and deleting your data
We keep your data while your account exists. You can delete everything at any time in the app: Settings → Profile → Delete account and all data. That removes your photos from storage and your profile, hunts, streak, likes, blocks and reports from our database straight away, and removes your sign-in.
Children
Kolir isn't directed at children under 13, and we don't knowingly collect their data. If you believe a child has an account, write to us and we'll delete it.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your data, and to object to how it's used. Write to us and we'll help — most of it you can also do yourself in the app.
Changes
If this policy changes in a way that matters, we'll say so in the app before it takes effect.