Privacy Policy · Pomo Games

Last updated 4 November 2026.

Pomo Games is the games studio of DM Media Solutions, based in the United Kingdom. This policy covers this website and our games, including Koball, Little Waterways and Purr & Seek. We keep what we collect to the minimum the feature needs, and we never sell it.

In our games

Pomo account (optional)

You can play without an account. If you create one, so that one login and one name work across our games, we hold:

Your email address and password. Sign-in is handled by Google Firebase Authentication. Your password is stored by Google in hashed form; we never see it.
Your Pomo name, which is public: it is the name shown on leaderboards.
Your profile picture, if you choose one. It is one of a set of pictures we provide (you can't upload your own), and it is public: it is shown next to your Pomo name on leaderboards, shared islands and friends lists.
Which of our games you have linked and when, so that a game can unlock a reward for linking another.
A few progress milestones from each game, such as the level you have reached, so that another of our games can unlock a reward for them. Only you and our games can see these.
A one-time code when you verify your email. Only a scrambled (hashed) copy is kept, for 30 minutes.

We use your email to sign you in, to send verification codes and password resets, and for nothing else. We don't send marketing to it.

Leaderboards

If you put a name on a leaderboard, that name and your best score are public. In Koball that also means your best score of the week and the world you set it in. Each device also gets a random anonymous ID from Google Firebase, so that only you can post scores under your name. It isn't linked to who you are.

Little Waterways doesn't use that anonymous ID. Its leaderboard belongs to your Pomo account, so you only appear on it if you sign in, and it shows your Pomo name and your progress.

In Purr & Seek, if you sign in to a Pomo account, your Pomo name, your weekly challenge time and your star total can appear on its leaderboards.

Shared islands, flowers and friends

In Little Waterways, players with a Pomo account can choose to share more. None of this happens unless you sign in and use these features:

Your shared island. If you share My Island, other players can visit a copy of its layout, with your Pomo name on it.
Flowers. If you leave a flower on someone's island, they see your Pomo name next to it, and we record which account left it.
Friends. If you add a friend, we store the link between your two accounts so that you can find each other's islands and progress.
Reports and blocks. If you report an island or block a player, we store that so we can review the report and keep that player's island and flowers away from you.

Players can't send each other free-text messages.

Friends also work in Purr & Seek: friends you add through your Pomo account appear in its weekly challenge, and you can block or report a player there.

Game progress

Your progress, coins, unlocked items and settings are saved on your device. Deleting the game deletes them.

Koball cloud save. From Koball 1.1, if you are signed in to a Pomo account, Koball also stores a copy of your progress with that account, so that it can be restored on another device: your coins, unlocked balls and worlds, level and XP, lifetime distance, best score, power-up levels, awards, daily streak, presents, mission and reward timers, and which one-time purchases have already been paid out. It doesn't include your settings, your ad or consent choices, or any device identifier. Only you can read it, and deleting your Pomo account deletes it. If you aren't signed in, nothing is saved online.

Little Waterways can also keep a copy in your own cloud storage. On iPhone and iPad, iCloud sync copies your save to your own iCloud account so that it follows you across your devices; you can switch it off in the game's settings. On Android, your save is included in your device's Google backup if you have backup turned on. Those copies sit in your Apple or Google account, under their terms. We can't see them, and signing in to a Pomo account doesn't upload your save to us, only the few progress milestones described under Pomo account above.

Some of our free games show ads. Koball shows them from version 1.1: full-screen ads between some runs, and videos you can choose to watch for a reward. Purr & Seek has videos you can choose to watch for a reward. Little Waterways shows them from version 1.1 (on Android first, iPhone and iPad later): full-screen ads between some levels, and videos you can choose to watch for a bonus. None of our games show banner ads.

Ads are supplied by Unity (Unity LevelPlay, ironSource Ads and Unity Ads) and Google (AdMob). To show and measure ads, these partners may collect, through their own software in the game, your device's advertising identifier (IDFA on iPhone, Advertising ID on Android), your IP address and the approximate location it gives, device and app information (model, operating system version, language and app version), and how you interact with ads. We don't receive your name, email address or contacts from this.

In the UK, the EEA and Switzerland the game asks for your consent before any ad is requested, and ads stay off for that session if you don't answer. If you don't consent to information being stored on or read from your device, the partners are told so and may only show ads that aren't personalised. You can change your choice at any time in the game's Settings, where a privacy choices entry appears wherever the law requires one. On iPhone and iPad the game also shows Apple's tracking prompt. Refusing it doesn't stop ads; it stops tracking across other companies' apps and websites.

In Little Waterways the question comes from Google's consent form or, where Google says one isn't needed, the game's own "Ads and your data" question (Accept or No thanks), which asks whether our partners Unity, ironSource, Google and Meta may use data to personalise and measure ads. On iPhone and iPad, Apple's tracking prompt follows it. Choosing No thanks still shows ads, but not personalised ones. You can change your answer at any time in Settings → Ad privacy choices.

In Purr & Seek the question comes the same way, once the first level is finished: from Google's consent form or, where Google says one isn't needed, the game's own "Ads and your data" question (Accept or No thanks), which asks whether our partners Unity, ironSource, Google and Meta may use data to personalise and measure ads. On iPhone and iPad, Apple's tracking prompt follows it, unless you chose No thanks. Choosing No thanks still shows ads, but not personalised ones. Subscribers don't see ads or the tracking prompt.

Meta in Little Waterways. From version 1.1 on iPhone and iPad, and 1.2 on Android, Little Waterways uses the Meta (Facebook) SDK to measure its advertising. It sends Meta Platforms Ireland Ltd app events (install, app opens, levels completed, tutorial completed, purchases with their value and currency, and the ad revenue for each ad shown) and, where permitted, your device's advertising identifier: the IDFA only if you allow tracking in Apple's prompt, and the Advertising ID on Android. It doesn't send your name, email address or Pomo account ID. In the UK, the EEA and Switzerland nothing is sent to Meta until you tap Accept on the "Ads and your data" question; elsewhere, only after the consent flow above. You can change this at any time in Settings → Ad privacy choices. On iPhone and iPad, if you don't allow tracking, Meta only receives Apple's anonymous SKAdNetwork install reports.

Meta in Koball. From version 1.2 on iPhone, iPad and Android, Koball uses the Meta (Facebook) SDK in the same way: it sends Meta the same kinds of app events (install, app opens, player levels reached, tutorial completed, purchases with their value and currency, and the ad revenue for each ad shown) and, where permitted, your device's advertising identifier (the IDFA only if you allow tracking in Apple's prompt, and the Advertising ID on Android), never your name, email address or Pomo account ID. In the UK, the EEA and Switzerland nothing is sent to Meta until you tap Accept on Koball's "Ads and your data" question; elsewhere, only after the consent flow above. You can change this at any time in Settings → Privacy settings. On iPhone and iPad, if you don't allow tracking in Apple's prompt, Meta only receives Apple's anonymous SKAdNetwork install reports.

Meta in Purr & Seek. Purr & Seek uses the Meta (Facebook) SDK to measure its advertising. It sends Meta Platforms Ireland Ltd app events (install, app opens, tutorial completed, player levels reached, free trials started, purchases with their product, value and currency, and the estimated ad revenue for each ad shown), along with your IP address and device and app information, and, where permitted, your device's advertising identifier: the IDFA only if you allow tracking in Apple's prompt, and the Advertising ID on Android. It doesn't send your name, email address or Pomo account ID. In the UK, the EEA and Switzerland nothing is sent to Meta unless you agree in the game's consent question, and you can change your answer at any time in Settings → Privacy choices. On iPhone and iPad, if you don't allow tracking in Apple's prompt, or you aren't shown the prompt because you subscribe, the game still sends Meta these app events, but without the IDFA and with advertiser tracking switched off, so Meta uses them only in aggregate to measure our advertising and not to target ads at you.

Buying Remove ads (a one-time purchase) turns off the full-screen ads shown between runs in Koball and between levels in Little Waterways. Videos you choose to watch for a reward stay available. Ads in our games are aimed at a general audience aged 13 and over.

The partners' own policies apply to what they collect: Unity (unity.com/legal/privacy-policy) Google (policies.google.com/privacy, and how Google uses information from apps that use its services) and Meta (facebook.com/privacy/policy).

Analytics in games

Google Analytics for Firebase is switched off by default. It is only turned on if you consent (or where consent isn't legally required), and tells us things like how many people play and which levels they reach. It doesn't tell us who you are.

Little Waterways uses Google Analytics for Firebase from version 1.1, on the same terms: it is only turned on after you consent where consent is required. It records how the game is played, such as levels started, won and failed, ads shown, purchases (with their price and currency) and a few broad groupings like how far you have got. It doesn't send your name, email address or Pomo account ID.

Purr & Seek uses Google Analytics for Firebase on the same terms: it is only turned on after you consent where consent is required. It records how the game is played, such as levels played, ads shown, purchases and subscriptions (with their price and currency) and a few broad groupings like how far you have got. It doesn't send your name, email address or Pomo account ID.

Crash reports

If Koball or Little Waterways crashes, it sends a crash report through Google Firebase Crashlytics: the technical details of the crash, the device model, operating system version, free memory and a random installation ID. We use these reports only to find and fix bugs. They are not used for advertising and are kept for 90 days.

Little Waterways uses Crashlytics from version 1.1, in the same way and only to fix bugs.

Start-up diagnostics (Koball on Android)

On Android, Koball sends an anonymous note of how far each launch got, with the device model and operating system version, so that we can find phones the game fails to start on. It carries no account, advertising or installation identifier, the IP address isn't logged, and it is kept for about 30 days.

Notifications

If you allow notifications, the game schedules reminders on your device, for example when your daily reward or a free present is ready. They are created on your phone; we don't send them from a server and we don't collect anything for them.

Purchases

In-app purchases are handled entirely by Apple or Google. We never see your payment details; we only learn that a purchase was made so the game can unlock it and restore it on a new device.

In Purr & Seek, a subscription removes ads. You manage or cancel it with Apple or Google.

On this website

Contact form. When you send us a message we receive your name, email address and the message itself, so that we can reply. We do not use these details for marketing.

To know whether our emails are useful, they contain a tiny image and links that tell us when an email is opened and which link was clicked, along with the kind of device or mail app and the rough country. We use this only to improve and time our emails. If you would rather not, most mail apps let you block images, and that stops open tracking.

Analytics. We use Google Analytics to understand which pages people find useful. It only loads if you accept the cookie notice, and IP addresses are anonymised. If you decline, no analytics request is made at all.

Signing in to your Pomo account. You can sign in on this website with the same Pomo account you use in our games, to see your Pomo name, profile picture, which of our games you have linked, and your progress and leaderboard places. Signing in is optional and works the same way as in the games: your email and password go straight to Google Firebase Authentication over an encrypted connection, and this website never stores or sees your password. The page then reads your own account directly from Google Firebase, in your browser; none of it is sent to or kept on this website's server.

Signed in, you can also do here what you can do in the games: verify your email with a one-time code, pick your Pomo name, choose your profile picture, and add, accept or remove friends. These go straight from your browser to the same Pomo account service the games use, and are kept exactly as described under Pomo account and Shared islands, flowers and friends. You can also ask for a password reset email; for that we use the email address you type in, only to send that email. The leaderboards page shows the same public names, pictures and scores as the games do.

To keep you signed in, your browser stores a sign-in token in its local storage on this website. Choosing Sign out removes it, and if you untick Stay signed in it is removed when you close the tab. It isn't used for analytics or advertising.

Cookies. We store one cookie to remember your answer to the cookie notice. Analytics cookies are only set once you have accepted. The sign-in token above is kept in local storage, not a cookie, and only if you sign in.

Embedded video. Devlogs are hosted on YouTube. Videos load only when you click play, and we use YouTube's no-cookie domain, so nothing is sent to Google until you choose to watch.

YouTube

We publish videos of our own games to our own YouTube channel. To do that, our internal publishing tool uses YouTube API Services. It is used only by our team and only for our own channel: it uploads videos we have approved and adds them to our playlists, and it reads the basic details and view counts of our own videos.

By watching or interacting with our videos on YouTube you are using YouTube, which is covered by the YouTube Terms of Service, and Google handles that data under the Google Privacy Policy.

Our tool does not collect, store or share any data about YouTube viewers. The only YouTube data we keep is the ID, link and view counts of the videos we uploaded, alongside our own records of each post, for as long as we keep that post's record. The access we granted to our tool can be removed at any time from Google's security settings at myaccount.google.com/permissions; when it is removed, our tool can no longer reach the channel, and we delete the stored access token. You can ask us to delete any YouTube data we hold through our contact form, and we will do so within 7 days.

Why we're allowed to use it

To provide what you asked for (contract): your Pomo account, sign-in emails and purchases.
Legitimate interests: running fair leaderboards, moderating shared islands, keeping accounts secure, preventing abuse and fixing crashes.
Your consent: personalised ads, analytics, cookies and the newsletter. You can withdraw it whenever you like.

Who processes it, and where

Google (Firebase) hosts our accounts, leaderboards, profile pictures, Koball cloud saves, friends lists and shared islands, and receives crash reports. Pomo account records are stored in the European Union; sign-in data and leaderboard processing may also take place in the United States. Account emails and newsletters are sent from our own mail server in the UK, and the newsletter list is stored on this website's server, also in the UK. The ad partners above (including Meta) and Google Analytics process data under their own terms, which include approved safeguards for transfers outside the UK and EEA.

How long we keep it

Pomo account details: until you delete the account.
Koball cloud saves: until you delete your account.
Leaderboard names and scores: until you delete your account or ask us to remove them.
Shared islands, flowers and friends lists: until you remove them or delete your account.
Reports and blocks: for as long as we need them to moderate shared content, and no longer than your account exists.
Verification codes: 30 minutes.
Crash reports: 90 days.
Koball start-up diagnostics: about 30 days.
Contact form messages: for as long as it takes to deal with your message, and no longer than two years.
Newsletter: until you unsubscribe. After that we keep only a record that you did, so you are never emailed again by mistake; ask us and we will delete that too. Sign-ups never confirmed are deleted after 30 days.

Deleting your Pomo account

In any of our games, open Settings → Pomo account → Delete account and confirm with your password. That permanently deletes the account, your Pomo name, your profile picture, your linked games and progress milestones, your Koball cloud save, your leaderboard entries, your shared island, your friends list, and the flowers you have given and received. It doesn't clear the progress saved on your device; deleting the game does that. You can also ask us to do it for you: see how to delete your account.

Children

Pomo accounts are for players aged 13 and over. We don't knowingly collect personal information from younger children. If you believe a child has given us their details, tell us and we will delete them.

Your rights

You can ask us what data we hold about you, ask for it to be corrected, ask for a copy, or ask us to delete it. Use the contact form and we will action it. If you're unhappy with how we've handled your data you can complain to the UK Information Commissioner's Office at ico.org.uk.

Changes

If we change what we collect, we'll update this page and the date at the top.