Privacy policy

Who processes your data

The game owner and data operator is Pavel Andreevich Dreizer, self-employed (CountXIII). Contact: cafe-lapka@yandex.ru. This policy covers the Android version of Lapka: Cozy Cafe on Google Play, package com.cafelapka.android.

On-device play and cloud saves

Your cafe and preferences are saved on this phone. Ordinary play works offline without an account. Optional VK ID (including OK and Mail in its sign-in window) or Yandex ID sign-in enables cloud saves for recovery on another device.

When you sign in, our server receives a verified service identifier. It stores an internal cafe account, linked sign-in methods, progress, game actions, help operations and short technical error codes. Random device and session keys support sign-in and save protection. The sign-in key is kept in protected phone storage; the server stores its hash.

The game does not receive your VK or Yandex password or store the profile, email or phone number returned by the sign-in service. These services process sign-in under their own policies. If you contact support, we receive your sender email address and the information you include in the request.

Google sign-in on Google Play

Starting with version 0.1.12, the Google Play build supports optional Google sign-in through Android Credential Manager. This sign-in method is absent from the ordinary APK and RuStore version. A signed Google ID token is sent to our server over HTTPS to verify its signature, audience, expiry and association with the phone request.

The token may contain a name, email address and profile image URL. These are processed only in memory for the verification request; the token, these fields and the profile image are not retained in the database or logs. The image is not downloaded. Cloud storage retains only the verified Google identifier and its link to the cafe account. Google data is not passed to the advertising SDK or used for advertising.

Google handles sign-in under its privacy policy. Signing out of the cafe revokes this phone’s access and clears the game’s Google account chooser state. Deleting the cafe removes its link to Google and access from devices; your Google Account remains.

Yandex advertising

Yandex Mobile Ads serves a banner, full-screen ads between shifts and optional rewarded videos for extra help. The SDK may process an available advertising identifier, technical device and network information, and ad interactions. Advertising identifier availability depends on Android settings.

Location tracking is disabled. The app does not request precise or approximate location permissions. The current configuration passes personalized-ad consent as false. Exact age is not collected or passed to the SDK. VK/Yandex account identifiers, sign-in keys and cafe progress are not passed to the advertising SDK.

Yandex processes ad data under its privacy policy. QA builds use demo ads. Unavailable ads do not prevent ordinary play. The Android version has no in-app purchases.

Why data is used

Cloud data supports sign-in, progress recovery, save protection and rewards being granted only once. Action events and short error codes help us understand how the game works and resolve problems. Yandex uses advertising data to serve and measure ads. We do not sell player progress or account identifiers.

Data location and security

The game server is located in Russia. Connections to our API use HTTPS; the advertising SDK transmits data using HTTPS/TLS. Database and backup access is restricted. Network information needed to operate the server may appear in diagnostic and security logs.

Retention

Your cloud profile is retained while you use it or until you request deletion. Inactive profiles currently have no automatic deletion deadline. Daily backups are scheduled to be retained for up to 30 days and expire through rotation. Deleted profiles must be erased again before an older backup is used.

For safe retries, a technical deletion receipt is retained for up to 30 days: a hash of the random device key and an expiry time, without account or sign-in provider identifiers. Support correspondence is processed to answer and fulfill the request.

Account deletion and data requests

In the game, open Settings → Account → Delete account after signing in, then confirm. This removes your cloud cafe, progress, coins, upgrades, game and advertising operations, linked sign-in methods and access from all devices. Local saves on this phone are also removed.

You can request deletion without installing the app using the account deletion page. We explain how to verify ownership and confirm completion. You can also contact support to request access to or correction of your data.

Your Google, VK and Yandex accounts remain. Clear local copies on other phones separately. Uninstalling the app does not delete the cloud account. Signing in after account deletion creates a new empty cafe.

Google Play audience

The Google Play version is intended for teenagers aged 13 and older and adults. It is not directed at children under 13. If you believe that a child under 13 has provided data to us, contact support so we can review and delete it.